Forum Discussion

JDamian's avatar
JDamian
Icon for Nimbostratus rankNimbostratus
Jun 23, 2023

[X509::whole [SSL::cert 0]] shows incomplete certficate

Hi

In order to debug a problem regarding client certificates I added a line into a iRule for logging the certificate:

 

log local0.info "ClientSide [IP::client_addr] - Certificate: [X509::whole [SSL::cert 0]]"

but in /var/log/ltm the PEM stuff appears incomplete (no END CERTIFICATE line is logged):

ClientSide 10.179.37.156 - Certificate: -----BEGIN CERTIFICATE----- MIIIejCCBmKgAwIBAgIJQ2+FiEwmZX6sMA0GCSqGSIb3DQEBCwUAMIHTMQswCQYD VQQGEwJFUzEWMBQGA1UECwwNQUMgQ0FNRVJGSVJNQTEbMBkGA1UECgwSQUMgQ2Ft ZXJmaXJtYSBTLkEuMRIwEAYDVQQFEwlBODI3NDMyODcxSzBJBgNVBAcMQk1hZHJp ZCAoc2VlIGN1cnJlbnQgYWRkcmVzcyBhdCBodHRwczovL3d3dy5jYW1lcmZpcm1h LmNvbS9hZGRyZXNzKTEuMCwGA1UEAwwlQ2FtZXJmaXJtYSBDb3Jwb3JhdGUgU2Vy IERFIEdBTElDSUExFjAUBgNVBAMMDXNhcmEueHVudGEuZXMxCzAJBgNVBAYTAkVT dmVyIElJIC0gMjAxNTAeFw0yMDA5MjUxMjExMjlaFw0yMTA5MjUxMjExMjlaMIGQ MR8wHQYDVQQHDBZTQU5USUFHTyBERSBDT01QT1NURUxBMRIwEAYDVQQFEwlTMTUx MTAwMUgxGTAXBgNVBAsMEFhVTlRBIERFIEdBTElDSUExGTAXBgNVBAoMEFhVTlRB MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBC8KCAQEArA/XpcQVHWPy5tebVwS1 nyGIOGBkNof3PByhlfNoAl3k5ax3FRzIo8Y+zV+dmQh9V03knl7XSqhabzfi8PVc ytAauwe2sCskbt62zusOAnBKVkwIyirFHktqL6oc3TwDT7Z1iwUjgjjdX2SfxiSP 8B+0NYaCB

 

Is it due to a size limit for log messages or the certificate has been actually trimmed?

 

Best regards

 

devops
  • Paulius's avatar
    Paulius
    Icon for MVP rankMVP
    Jun 23, 2023

    JDamian I know that the F5 typically doesn't look at HTTP responses after a certain line for HTTP health monitors so it could be a similar situation for this logging information. It's possible that we can assist in resolving your greater issue if you can expand on what issue you're having that resulted in you having to log the SSL certificate of a connection.

    • JDamian's avatar
      JDamian
      Icon for Nimbostratus rankNimbostratus
      Jun 26, 2023

      My greater issue is that after my LB team upgraded a F5 BIG IP device to 16.1.3.4 some apps requiring client certificate stopped working properly from certain clients -- an iRule did the job of requiring the certificate for last 5 years.

      We have narrow down the problem to .NET client connections because the same client requests from SOAP-UI or Java have no problem.

  • Adrian_Turcu's avatar
    Adrian_Turcu
    Icon for Nimbostratus rankNimbostratus
    Apr 12, 2024

    you could split the base-64 output from [X509::whole [SSL::cert 0]] by newline , then log each individual line instead of the entire cert at once:

    foreach line [split [X509::whole [SSL::cert 0]] "\n"] {
      log local0. "$line"
}

    not pretty, nor efficient but it achieves the end-goal of having the entire certificate dumped into the logs...