Forum Discussion
Derek_Nelson_10
Nimbostratus
Aug 24, 2005Problem with Certificate Hash verification
Hi all.
I'm having a problem with verifying connections to a particular proxy that "requires" a client cert. The proxy is inserting the Certificate Serial Number and Certificate Hash into th...
Martin_Machacek
Sep 12, 2005Historic F5 Account
Derek,
to troubleshoot your problem add to your rule logging of the cert hash extracted from the header, like this:
if (http_header("SSLClientCertSerialNumber") == one of Cert_SN and
http_header("SSLClientCertHash") == one of Cert_Hash) {
log "MutualSSL accepted from:${client_addr} hash: " + http_header("SSLClientCertHash")
use pool web-pool
}
else {
log "MutualSSL Denied from:${client_addr} hash: " + http_header("SSLClientCertHash")
discard
}
That will allow you to find out what you need to match.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects