Forum Discussion
bdavis
Feb 15, 2019Nimbostratus
SNI & Subject.DN Question
I have a use case where I filter traffic based on the SNI value gained by a binary scan in CLIENT_DATA but in some cases SNI value is null. I'm wanting to look at the servers subject.dn when this hap...
rob_carr
Feb 18, 2019Cirrostratus
Why not signal the need to check subject.dn based on the absence of your SNI info?
Pseudocode:
when CLIENT_DATA {
set check_subject_dn 0
if { [SNI existence check goes here]}
[extract SNI and do whatever]
} else {
set check_subject_dn 1
}
}
when SERVERSSL_SERVERCERT {
if { ([SSL::cert count] != 0) && $check_subject_dn }{
set cert [SSL::cert 0]
set subject_dn [findstr [X509::subject [SSL::cert 0]] "CN=" 3 ","]
log "gn_proxy: Server Certificate Received: $subject_dn [IP::server_addr]"
}
}
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects