Forum Discussion
SSL Handshake failure / Verify irule
I'm trying to Troubleshoot the below Issue.
Application sends an certificate to the LTM (it is set up on https URL to send certificate to ltm to authenticate itself has valid), the below irule is used to authenticate the Client and forward the http request to the Server.
LTM uses clientside ssl to encrypt client side transaction and connection between ltm and server is encrypted with certificate hosted on the Server.
rule abc-ssl-rule {
when CLIENTSSL_HANDSHAKE {
if { [SSL::cert count] > 0 }
{ log "Client cert is OK; releasing HTTP request."
HTTP::release
}
}
when HTTP_REQUEST {
if { [class match [HTTP::uri] starts_with abc_p_6401-ssl-class] }
{ log "Certificate required for: [HTTP::uri]"
if { [SSL::cert count] < 1} {
log "No cert found. Holding HTTP request until a client cert is presented..."
HTTP::collect
SSL::session invalidate
SSL::renegotiate enable
SSL::authenticate once
SSL::authenticate depth 9
SSL::cert mode require
SSL::renegotiate
log "SSL renegotiated"
}
}
}
when HTTP_REQUEST_SEND {
clientside {
if { [SSL::cert count] > 0 } {
HTTP::header insert LTM_CLIENT_CERT [X509::whole [SSL::cert 0]]
log "Client cert forwarded to server"
}
}
} }
There are 2 different SCenarios observer.
-
SSL handshake fails after client sends client cipher spec and logs on the LTM . SSL handshake failure FatalError(20).
-
On other set up ,Reset request is sent after server sends the Change Cipher Spec message is sent thereby closing the TCP connection.
Any ideas , as to what would result in this behaviour.? llet me know if more data required.
2 Replies
- What_Lies_Bene1
Cirrostratus
Hmmm, I'm not sure about your logic here. What do you want to do? I'm guessing here;
- CLIENTSSL_HANDSHAKE: If the client presents a cert, log the fact and proceed. If no cert, proceed.
- HTTP_REQUEST: If a specific URI is requested, check a cert was presented. If not, force renegotiation. If so, proceed.
- HTTP_REQUEST_SEND: Use clientside context, insert SSL certificate used as a header.
Not sure why you are using HTTP::collect/release.
Why force renegotiation? If the client didn't present a certificate first time, why would this help?
- Kevin_Stewart
Employee
I believe your iRule is essentially correct. Two things:
-
If you remove the iRule, does it work?
-
Do you see any errors in the LTM log with the iRule in place?
-
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com