Turn off client auth if uri equals
Customers connect to one IP. They connect with an app, not a browser. They use port 5443 to register (obtain a cert we issue) for the service, and port 443 for the actual service.
register: https://5.5.5.5:5443/register (1-way ssl) (get the cert)
service: https://5.5.5.5/service (2-way ssl) (use the cert)
We have a registration VS and a service VS. Both VS's have their own client ssl profile (no server profile). Below are the differences in the ssl profiles:
I am tasked with getting rid of port 5443 and making it so that customers can both register and hit the service on port 443/https. The majority of the traffic comes in on 443 with the occasional new customer registering first on 5443. The VS's point to different pools. We are running BIG-IP 11.3.0 Build 2806.0 Final.
With that being said, I'd like to make the 2-way ssl profile the default and turn off client auth if uri equals "/register". Here is what I have so far...
when HTTP_REQUEST {
Turn off client auth for registration requests
if { [HTTP::uri] contains "/register" } {
SSL::cert mode ignore
SSL::renegotiate enable
SSL::renegotiate
pool registration-pool
return
} elseif { ([SSL::cert count] > 0) && ([HTTP::uri] contains "/service") } {
scrub header
HTTP::header remove chain
HTTP::header remove client
HTTP::header remove testCert
HTTP::header remove ClientCert-Subject
HTTP::header remove SSLClientCertSubject
HTTP::header remove SSLClientCertThumbprint
insert cert subject
HTTP::header insert SSLClientCertSubject [X509::subject [SSL::cert 0]]
} else {
drop
}
}
Concerns:
- When to use "return" and "SSL::renegotiate"
- Security (ssl renegotiate vulnerabilities)
- Do I need to set variables?
Very grateful for any help on this. Thanks.