Forum Discussion
Muhammad_Irfan1
Cirrus
CirrusServer and client certificate CN should match or not in client authentication
During client authentication set to require.
F5 certificate CN and Client certificate CN should match?
I uploaded CA bundle through GUI but that is not shown in
/config/file...
F5 certificate CN and Client certificate CN should match?
no, cn should not be the same because they authenticate different things (one authenticates server but the other one authenticates client).
I uploaded CA bundle through GUI but that is not shown in /config/filestore/files_d/Common_d/certificate_d
i understand it is correct. trust_certificate_d is for device trust.
nitass_89166
Noctilucent
Noctilucenti do not know what the full name of CHecking.crt in filestore is and what and where the client certificate file is. anyway, this is an example.
openssl verify -verbose -CAfile /config/filestore/files_d/Common_d/certificate_d/\:Common\:chain.crt_39032_1 /var/tmp/client2.crt
Muhammad_Irfan1Cirrus
CirrusI have uploaded CA bundle but when looking into that certificate_d folder they are converted into 3 certificates of CA which bundle contained.
Now I am scratching my head.
1. server authentication is successfully done,
2. now client authentication is not working.
3. certificate authority of both F5 and client certificates is same.
4. Certificate authority have 2 intermediate and 1 root cert, put in browser and converted into bundle and put in F5 as well.
5. Any certificate issued by mobilink to client will work or for this application client certificate will have something unique which will identify that this certificate is for this app.
6. Have you performed client authentication before? I want all the clients have the same cert and f5 will not have that cert, f5 will only have ca bundle to validate client cert right?
7. If that same bundle is working in server authentication then same bundle should work in client authentication as issuer of both is same.
8. The testing I am doing is with cert which was for some other purpose but issued by mobilink so that will work for client authentication as well right as F5 only checks issuer?
