ciscoarc
May 29, 2018Nimbostratus
Verifying CN received (client auth)
Hi guys,
I'm trying to verify client auth certificate and using this iRule, but from the logs I can see it's always Accepted even though my trusted_certs only has 1 CN;
i.e: my trusted_certs is "CN" = "3456.mycompany.com" ;
But even if I send 1234.mycompany.com it still says Client Certificate Accepted:CN=1234.mycompany.com
when CLIENTSSL_CLIENTCERT {
if { [SSL::cert count] != 0 }{
set cert [SSL::cert 0]
set subject_dn [findstr [X509::subject [SSL::cert 0]] "CN=" 0 ","]
log "Client Certificate Received: $subject_dn"
}
if { ([matchclass $subject_dn contains trusted_certs]) } {
log "Client Certificate Accepted: $subject_dn"
} else {
log "No Matching Client Certificate Was Found Using: $subject_dn"
reject
}
}