Forum Discussion
Brian_Ledbetter
Nimbostratus
NimbostratusSSL::renegotiate fails
Howdy all,
I'm trying to selectively enable PKI on one of our websites, and am using the example listed in the iRule wiki, but rather than seeing the web browser request that the user provide a client certificate, the request ends up timing out.
Have any of you seen this before? Do I need to set any specific configuration options on the clientssl profile in order to use the SSL::renegotiate command?
For reference, here is the rule I'm trying to use:
http://devcentral.f5.com/wiki/default.aspx/iRules/SSL__renegotiate.html
Regards,
Brian
2 Replies
dimka___104021hi,
I've tried to use SSL::renegotiate, but it didn't work like it should.
If you want to store some client cert data into session table - forget it.
Session lookup doesn't work with SSL::renegotiate. Even support said "This really falls outside the realm of technical support".
Brian_LedbetterI ended up forwarding the request from the non-PKI server to a virtualhost that has PKI configured, and used another iRule to set an authenticated cookie. Not quite as clean of a solution, but it seems to be good enough for now.
