Doing mTLS Authentication per URL
Published Dec 05, 2022
Version 1.0Was this article helpful?
Hi jhosseini ,
The non-sensitive URL is identified after the mTLS handshake is completed. As mentioned in the article, mTLS is processed before the HTTP layer. It is not possible to remove the client certificate request during mTLS handshake when the client even has not sent the HTTP request containing the URI.
The above solution still allows clients who establish mTLS connections without client certificate and request for non-sensitive URL. This is because the VS' ClientSSL profile is configured with "request" flag and the client is free to ignore the request. The VS will still allow clients coming in without client certificate.