Forum Discussion

ebrc's avatar
ebrc
Icon for Nimbostratus rankNimbostratus
Jan 30, 2019

Reject connections with no extention keyusage in client certificate

Good morning everyone!   One of our client is asking me to be able to block all connections where the client certificate does not contain the keyusage extention.   I found this link which i...
application delivery
iRules
LTM
Lee_Sutcliffe's avatar
Lee_Sutcliffe
Icon for Nacreous rankNacreous
Jan 30, 2019

As per the documentation in the Wiki you provided, the command 

X509::extensions
returns 
"(no extensions)"
if the certificate doesn't have any extensions.

Most of the information you need to put a very simple iRule together can be found in the example section of the Wiki. In it's simplest form you could use the following:

when CLIENTSSL_CLIENTCERT {
    if {[X509::extensions [SSL::cert 0]] eq "(no extensions)"} {
        reject
    }
}