SSL/NON-SSL

Hi Willda71,

 

 

Yes. The F5 can detect if the Client has a Client SSL Certificate. This is configured in the Client side SSL Profile (what is applied in the Virtual Server under SSL Profile (Client)).

 

 

To configure the profile you go to (on v10.x.x): Profiles -> SSL -> Client

 

 

Select the Client SSL Profile (or create a custom SSL Profile (Recommended)) and scroll down to the "Client Authentication" Area. The help for these options are pretty good so you should not have any problems configuring the base requirements.

 

 

You will then need to decide what to do with what you get. That is all pretty much handled by an iRule. I would suggest reading up on the iRule event that you will be needing (CLIENTSSL_CLIENTCERT): http://devcentral.f5.com/wiki/iRules.CLIENTSSL_CLIENTCERT.ashx

 

 

Here is a really good example. This iRule requests a Client SSL Certificate based on the URI:

 

http://devcentral.f5.com/wiki/iRules.client_cert_request_by_uri_with_ocsp_checking.ashx

 

After doing some additional tinkering, you might want to ignore the SSL Profile and handle everything in an iRule (it is much easier to manage what is happening.

Here is a beginning example:

 
when HTTP_REQUEST {
log local0. "Beginning HTTP Request Event."
SSL::cert mode request
if { [SSL::cert count] == 0 } {
log local0. "SSL Certificate Count equals Zero.  Redirecting."
HTTP::redirect "http://www.google.com"
}
}

You will still need to handle the processing for which SSL Certificates you will consider valid and how you want to validate them, but again, it seems much easier to work with that information in an iRule.

Hope this helps.

If the back end server needs to see what client cert was presented, you can throw it in the HTTP header

 when HTTP_REQUEST {
if { [SSL::cert count] > 0 } {
set thecert [findstr [X509::whole [SSL::cert 0]] "-----BEGIN CERTIFICATE-----" 28 "-----END CERTIFICATE-----"]
set certnospace [string map -nocase {" " "" \n "" \r ""} $thecert] 
HTTP::header insert ssl.client_cert $certnospace

}
}

Thanks so much for that...

 

 

I found out I have mixture of different LTMs (different ones for different locations based on when they where purchased). So basically I have LTM 6400 v9.2.3 and LTM 6900 V10.2.0. Would the older versions need updating?

 

 

So what you are saying is that I don't need the APM to do this, just create an irule? I assume if I did use the APM (apart from other functionality and benefits an APM provides) would it provide a graphical interface to do this type of stuff.

 

 

Many thanks for your time.