Forum Discussion

Cirrus

Jul 10, 2019

Solved

Extract SAN from Client SSL Certificate & Insert into HTTP Header

Hi folks,

I'm working with some co-workers to setup some Slack.com forwarding in our environment. Mutual TLS and the insertion of the SAN from the client certificate into a HTTP header is a requirement. Can anyone help me come up with an iRule or LTM Policy to extract the SAN/CN from the client SSl cert and insert it as a HTTP header? Here's some additional info from Slack:

Configure your TLS-terminating server to request client certificates. Your server should accept client certificates issued by DigiCert SHA2 Secure Server CA, an intermediate CA under DigiCert Global Root CA. These CAs are included in many standard CA certificate bundles.

1- Extract either of the following fields in the certificate.
Subject Alternative Name: DNS:platform-tls-client.slack.com. By RFC 6125, this is the recommended field to extract.
or Subject Common Name: platform-tls-client.slack.com.

2- Inject the extracted domain into a header, and forward the request to your application server. Here's an example header you might add to the request: X-Client-Certificate-SAN: platform-tls-client.slack.com. Whatever you choose to call your header, check to make sure this header hasn't already been added to the request. Your upstream application server must know that the header was added by your TLS-terminating server as part of the Mutual TLS process.

When I apply that iRule my test cert works. Not sure why your environment is different. Here's an alternate iRule you could try.

when HTTP_REQUEST {
  if {[SSL::cert 0] ne ""}{
    set tmpcn [X509::subject [SSL::cert 0]]
    set cn [findstr $tmpcn "CN=" 3]
    HTTP::header replace X-Client-Certificate-SAN $cn
    
  } else {
    HTTP::header remove X-Client-Certificate-SAN
  }
}

My test results.

 curl -k --cert ./platform-tls-client.slack.com.crt --key ./platform-tls-client.slack.com.key https://192.168.1.200:8443/headers.json
{"User-Agent":"curl/7.29.0","Host":"192.168.1.200:8443","Accept":"*/*","X-Client-Certificate-SAN":"platform-tls-client.slack.com"}

Here's what my config looks like.

ltm virtual test_vs {
    creation-time 2019-08-27:10:03:53
    destination 192.168.1.200:pcsync-https
    ip-protocol tcp
    last-modified-time 2019-08-27:10:20:58
    mask 255.255.255.255
    pool slack_pool
    profiles {
        http { }
        mtls_clientssl {
            context clientside
        }
        tcp { }
    }
    rules {
        slack2
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    translate-address enabled
    translate-port enabled
    vs-index 3
}
 
ltm profile client-ssl mtls_clientssl {
    app-service none
    authenticate-depth 0
    ca-file f5ca
    cert-key-chain {
        default {
            cert default.crt
            key default.key
        }
    }
    defaults-from clientssl
    inherit-ca-certkeychain true
    inherit-certkeychain true
    peer-cert-mode require
}
 
ltm rule slack2 {
when HTTP_REQUEST {
  if {[SSL::cert 0] ne ""}{
    # extract SAN
    set santemp [findstr [X509::extensions [SSL::cert 0]] "Subject Alternative Name" 32 ","]
    # remove DNS: prefix
    set san [findstr $santemp "DNS" 4]
    # insert X-Client-Certificate-SAN header
    HTTP::header replace X-Client-Certificate-SAN $san
 
  } else {
    HTTP::header remove X-Client-Certificate-SAN
  }
}
}

8 Replies

Eric_Chen

Employee

Jul 10, 2019

I created the following codeshare example that does what is required to generate the X-Client-Certificate-SAN: https://devcentral.f5.com/s/articles/Slack-Mutual-TLS-Recipe-Adding-X-Client-Certificate-SAN-header-from-client-certificate

alanjohnson7467

Cirrus

Aug 27, 2019

Hi Eric,

Our application owners have finally gotten around to testing this and we are running into a slight problem. The header is getting inserted, but is including this full value which seems to be breaking things:

platform-tls-client.slack.com X509v3 Key Usage: critical Digital Signature

...do have any suggestions on how to remove the extra info in the value?

Thanks!

Eric_Chen

Employee

Aug 27, 2019

Can you send me a sample of your iRule? It is "weird" that it is grabbing that extra information. If you have a way to dump a copy of the Slack cert it would help. Here's my "test" cert that I have been using.

and my test CA

alanjohnson7467
Cirrus
Jul 10, 2019
Thank you so much Eric! I really appreciate it.

Best wishes,
Alan

DevCentral Quicklinks

* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com

Discover DevCentral Connects

* Podcasts
* Social Channels
* Video Streaming

GitHub Awesome-F5

Configure your TLS-terminating server to request client certificates. Your server should accept client certificates issued by DigiCert SHA2 Secure Server CA, an intermediate CA under DigiCert Global Root CA. These CAs are included in many standard CA certificate bundles.\n\n1- Extract either of the following fields in the certificate.\nSubject Alternative Name: DNS:platform-tls-client.slack.com. By RFC 6125, this is the recommended field to extract.\nor Subject Common Name: platform-tls-client.slack.com.\n\n2- Inject the extracted domain into a header, and forward the request to your application server. Here's an example header you might add to the request: X-Client-Certificate-SAN: platform-tls-client.slack.com. Whatever you choose to call your header, check to make sure this header hasn't already been added to the request. Your upstream application server must know that the header was added by your TLS-terminating server as part of the Mutual TLS process.\n

when HTTP_REQUEST {\n if {[SSL::cert 0] ne \"\"}{\n set tmpcn [X509::subject [SSL::cert 0]]\n set cn [findstr $tmpcn \"CN=\" 3]\n HTTP::header replace X-Client-Certificate-SAN $cn\n \n } else {\n HTTP::header remove X-Client-Certificate-SAN\n }\n}

curl -k --cert ./platform-tls-client.slack.com.crt --key ./platform-tls-client.slack.com.key https://192.168.1.200:8443/headers.json\n{\"User-Agent\":\"curl/7.29.0\",\"Host\":\"192.168.1.200:8443\",\"Accept\":\"*/*\",\"X-Client-Certificate-SAN\":\"platform-tls-client.slack.com\"}

ltm virtual test_vs {\n creation-time 2019-08-27:10:03:53\n destination 192.168.1.200:pcsync-https\n ip-protocol tcp\n last-modified-time 2019-08-27:10:20:58\n mask 255.255.255.255\n pool slack_pool\n profiles {\n http { }\n mtls_clientssl {\n context clientside\n }\n tcp { }\n }\n rules {\n slack2\n }\n source 0.0.0.0/0\n source-address-translation {\n type automap\n }\n translate-address enabled\n translate-port enabled\n vs-index 3\n}\n \nltm profile client-ssl mtls_clientssl {\n app-service none\n authenticate-depth 0\n ca-file f5ca\n cert-key-chain {\n default {\n cert default.crt\n key default.key\n }\n }\n defaults-from clientssl\n inherit-ca-certkeychain true\n inherit-certkeychain true\n peer-cert-mode require\n}\n \nltm rule slack2 {\nwhen HTTP_REQUEST {\n if {[SSL::cert 0] ne \"\"}{\n # extract SAN\n set santemp [findstr [X509::extensions [SSL::cert 0]] \"Subject Alternative Name\" 32 \",\"]\n # remove DNS: prefix\n set san [findstr $santemp \"DNS\" 4]\n # insert X-Client-Certificate-SAN header\n HTTP::header replace X-Client-Certificate-SAN $san\n \n } else {\n HTTP::header remove X-Client-Certificate-SAN\n }\n}\n}

Forum Discussion

Extract SAN from Client SSL Certificate & Insert into HTTP Header

8 Replies

The New F5 Certified BIG-IP Administrator Certification Exams Now Live

F5 Academies Are Back – And We’re Coming to a City Near You

Recent Discussions

Sending an HTTP request from iRule without delaying client requests

Route Domains HA & Traffic Groups

Horizon View iApp - Big-IP 17.5

r4600 Tenant CPU Assignment

BGP Over 2 vlans to 2 Network switch

Related Content

HTTPS Routing based on Client Certificates values with F5 Distributed Cloud

BIG-IQ Client Certificate (PKI) Authentication

Slack Mutual TLS Recipe: Adding X-Client-Certificate-SAN header from client certificate

Extracting the SNI server name

Help F5 Transform the BIG-IP Administrator Certification

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS