cert auth

2 Topics

(How) can I get two client certificates in one APM session?
I have a customer with iPads that need to authenticate to APM with a user certificate. This has been working fine, but there is also now need to read a field from a per-device certificate on each iPad and make use of this within the access policy. The two certificates are issued by different authorities. Maybe I am wrong, but it seems impossible to change the client SSL profile by renegotiating SSL during the session, so as to let me check the user cert and then the device cert. Does anyone know of a way? TMOS V16.1
gym1
Apr 30, 2024 Place Technical Forum
92Views
0likes
3Comments
Request client cert auth based on URL
I am trying to request client cert authentication based on select URL and it works with a whitelist only but when i use the negate in the datagroup with a datagroup including URI string values it does not work. Sounds perhaps weird but it seems that negating the datagroup with URI entries is not working properly. So when using a whitelist which should be bypassed it works and other websites are authenticated succesfully and a client certificate is being requested. In the client SSL profile we dont use the client cert authentication because we dont want the client cert authentication to be performed for all URLs, hence the SSL::renegotiate option. This seems to do the trick however while negating (not) against a list of websites that should use cert auth does not work and currently dont have the explenation for this behavior. We only have a list of websites that is using cert auth and not a full list of other websites that shouldnt use cert auth, therefor negating the websites would be the easiest solution. Is there any limitation with negating a datagroup with string values? Another side question is that we would like to perform the SSL::renegotiate and request a specific client cert from a certain CA issuer, how could we accomplish that? when HTTP_REQUEST { if {not[class match [string tolower [HTTP::uri]] contains DG_ACC_NO_CERT_AUTH] }{ #HTTP::header insert SSL_CLIENT_CERT [b64encode [SSL::cert 0]] log local0. "certificate not inserted and header SSL_CLIENT_CERT value is: [HTTP::header value SSL_CLIENT_CERT] for host [HTTP::host] and URI: [HTTP::uri]" } else { SSL::session invalidate SSL::authenticate always SSL::authenticate depth 9 SSL::cert mode request SSL::renegotiate enable SSL::renegotiate HTTP::header insert SSL_CLIENT_CERT [b64encode [SSL::cert 0]] log local0. "certificate inserted and header SSL_CLIENT_CERT value is: [HTTP::header value SSL_CLIENT_CERT] for host [HTTP::host] and URI: [HTTP::uri]" } }
Solved
Marvin
May 10, 2022 Place Technical Forum
2.7KViews
0likes
14Comments