X509::subject verification

Hi Ben,

 

 

You can also use a trusted CA cert in the client SSL profile to ensure the client cert is valid against the specific CA cert your clients have been given certs with.

 

 

matchclass (Click here) is for comparing a string or other token against a class (aka datagroup in the GUI). To validate the subject DN, you can use a string comparisons like:

 

 

string match -nocase *.example.com $subject_dn

 

 

or:

 

 

[string tolower $subject_dn] ends_with ".example.com"

 

 

You can also use a trusted CA cert in the client SSL profile and then check the SSL::verify_result Click here to check whether the cert was verified against the trusted CA cert(s).

 

 

Aaron