SSL Certificate Info put in HTTP Header after Renegotiate

I am trying to create a virtual server that can route traffic to different pools based on the URI, and can require client certificates only for specific URI patterns.

 

 

When the client certificates are required, I need to renegotiate the SSL and pass the client certificate subject in an http header to the pool destination. I need to be able to change the SSL profile to “clientprofile_1IBE_LCMX_cert_required” before the renegotiate so that the browser will present only certificates issued by a certain CA.

 

 

I have found numerous examples of pieces of this and have created the scenario below. It works as far as requiring a client cert only for the URI that begins with /certreq, but I then the request never gets sent to the selected pool.

 

 

In looking at my debug statements in the log, it looks like the HTTP_REQUEST_SEND event is not triggered after the SSL::renegotiate is done and the client certificate is sent. Is there something else that I have to do to release the http request after the SSL::renegotiate.

 

 

I am a newbie with irules, so any help would be appreciated. We are using version 9.4.7.

 

 

virtual vs_1IBE_MyApp {

 

snat automap

 

pool pool_1IBE_App1_dev

 

destination 192.168.1.18:20000

 

ip protocol tcp

 

rules irule_1IBE_ssl_renegotiate

 

httpclass

 

http_1IBE_LCMX_App1_a0

 

http_1IBE_LCMX_App2_a0

 

profiles

 

clientprofile_1IBE_LCMX_nocert

 

f5-dev-crypto-server

 

http

 

oneconnect

 

tcp

 

}

 

 

 

rule irule_1IBE_ssl_renegotiate {

 

when CLIENTSSL_CLIENTCERT {

 

log local0. "MyApp SSL verify_result is [SSL::verify_result]"

 

log local0. "MyApp SSL cert count is [SSL::cert count]"

 

set certcnt [SSL::cert count]

 

if { $certcnt > 0} {

 

log local0. "LCMatrix client certificate found. HTTP::release"

 

set ssl_cert [SSL::cert 0]

 

set ssl_subject [X509::subject $ssl_cert]

 

log local0. "LCMatrix client certificate subject is $ssl_subject for session [SSL::sessionid]"

 

session add ssl [SSL::sessionid] $ssl_subject 1200

 

log local0. "MyApp client certificate found. HTTP::release"

 

HTTP::release

 

}

 

}

 

when HTTP_REQUEST {

 

log local0. "MyApp request received for [HTTP::uri]"

 

if { [HTTP::uri] starts_with "/certreq" } {

 

set ssl_subject [session lookup ssl [SSL::sessionid]]

 

log local0. "MyApp client certificate required for: [HTTP::uri]"

 

if { $ssl_subject equals "" } {

 

log local0. "MyApp client certificate not found. Holding HTTP request until a client cert is presented..."

 

HTTP::collect

 

SSL::authenticate always

 

SSL::authenticate depth 9

 

SSL::cert mode require

 

SSL::renegotiate

 

set ssl_subject [session lookup ssl [SSL::sessionid]]

 

}

 

session add ssl [SSL::sessionid] $ssl_subject 1200

 

}

 

}

 

when HTTP_REQUEST_SEND {

 

clientside {

 

if { [HTTP::uri] starts_with "/plintl00" } {

 

pool pool_1IBE_LCMX_App2_a0

 

HTTP::header insert "X-SSL-Client-Cert-Subject"[X509::subject [SSL::cert 0]]

 

log local0. "MyApp subject header inserted [X509::subject [SSL::cert 0]]"

 

}

 

log local0. "MyApp request sent for [HTTP::uri]"

 

}

 

}

 

}

 

 

 

profile clientssl clientprofile_1IBE_LCMX_cert_required {

 

defaults from clientssl

 

key "keyf5cloudtest.key"

 

cert "cerf5cloudtest.crt"

 

client cert ca "ca-CommercialRSA.crt"

 

peer cert mode ignore

 

}

 

profile clientssl clientprofile_1IBE_LCMX_nocert {

 

defaults from clientssl

 

key "default.key"

 

cert "default.crt"

 

}

 

profile serverssl f5-dev-crypto-server {

 

defaults from serverssl

 

key "datapower_cert.key"

 

cert "datapower_cert.crt"

 

chain none

 

ca file none

 

ciphers "DEFAULT"

 

passphrase "abcdefghij"

 

options

 

dont insert empty fragments

 

modssl methods disable

 

renegotiate period indefinite

 

renegotiate size indefinite

 

unclean shutdown enable

 

strict resume disable

 

handshake timeout 60

 

alert timeout 60

 

cache size 20K

 

cache timeout 3600

 

}

 

 

 

profile httpclass http_1IBE_LCMX_App1_a0 {

 

defaults from httpclass

 

pool pool_1IBE_LCMX_App1_a0

 

redirect none

 

url rewrite none

 

asm disable

 

paths "/App1*"

 

}

 

profile httpclass http_1IBE_LCMX_App2_a0 {

 

defaults from httpclass

 

pool pool_1IBE_LCMX_App2_a0

 

redirect none

 

asm disable

 

paths "/App2*"

 

}

 

 

pool pool_1IBE_LCMX_App1_a0 {

 

monitor all https

 

members 192.168.1.18:10000

 

}

 

pool pool_1IBE_LCMX_App2_a0 {

 

monitor all https

 

members 192.168.1.18:20000

 

}