We have version 16 of BIG-IP LTM.
We have a virtual server on which several urls of the same domain are defined and which sends requests to the same pool of servers. On this virtual server and for a specific URL, we need double certificate authentication. Only a certificate should authorize the connection to the server pool. We want to check that the Common Name, Serial Number and Certificate Authority are correct to identify the certificate.
The virtual server "example.com" has the following URLs defined:
- url4.example.com with double authentication
- CommonName = url4.example.com
- serial_number = 0123456789abcdef
- certificate authority = MyCertificateAuthority
I wanted to know if it was possible to set the URL with double authentication on the same vhost as the other URLs or if it should be set on a new virtual server.
In the 2 cases, what configuration should be set up to solve this problem?
take a look at this knowledge base article: K13452: Configure a virtual server to serve multiple HTTPS sites using the TLS Server Name Indicatio....
You can use it to assign a specific SSL profile that requires client cert auth to the host you want to authenticate.
Please pay attention to URL, Host, FQDN and other terms. It makes discussions here in devcentral much easier when the correct terms are used.
Hello @Jean_Mamène ,
It should be possible to have this work on the same VIP, theorically.
To configure client authentication, You need to build a clientSSL profile and configure it for the specific SNI "url4.example.com", and enable client authentication with "require" setting on this same profile. You should import the trusted CA that singed this certificate on BIG-IP
Next step is verifying client-certificate informations (SN, etc.) at authentication time. This can be achieved via iRule.
You can get ideas from this code here, and tune it to check/match the requirements of your deployment.
I'm back to give you some news.
We have created a specific vhost for testing purposes and so as not to impact the other services hosted on the shared virtual servers.
The irule for verifying the CN and serial number of the certificate is up and running (validated by the customer).
We'll now look at configuring the SSL client profile.