Forum Discussion

fluffy_puffin_2's avatar
fluffy_puffin_2
Icon for Nimbostratus rankNimbostratus
Sep 27, 2018

Server Certificate CN Verification with iRule

Hi,

 

I wonder whether there is a way to verify server certificate CN with iRule. I know it is possible for client authentication, but can it be done for server side as well? Thank you for any suggestions.

 

iRules
security
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 27, 2018

    BIG-IP 13.1 introduces a new SERVERSSL_SERVERCERT event that can be used exactly like the CLIENTSSL_CLIENTCERT event.

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 27, 2018

    Hi,

    As you know when you do client auth on client side, it's client that provide certificate during handshake ssl.

    but in server side it will be F5 so you confirm that you want to retrieve CN in cert provide by f5? to the backend. it make sens?

    just for info if you want to retrieve cn (subject) from client cert:

    when HTTP_REQUEST {
  if {[SSL::cert count] > 0}{
    set cert [SSL::cert 0]
    set subject [string tolower [X509::subject $cert]]
  }
}

    regards