NimbostratusSSL Authentication issues
Our method is to have them purchase a cert from an authority
(although we’re trying to get self-signed certs to work for initial testing),
give us the serial of that cert and we’ll put it in a Data Group List that
our iRule checks. So we’ll check for a valid cert and that it matches our
list of serial s. Below is the iRule as it is now and a screen capture
of the section of the SSL Client profile I was talking about.
Some scratch notes from last night’s testing:
In Stage Environment:
if we request client cert, clients with no cert come through
if we require client cert, passes to iRule and valid clients are
rejected
IE8 get through
Firefox does not get through
iRule - ncf-tls-poc.443
when CLIENTSSL_CLIENTCERT {
if { [SSL::cert count] == 0 } {
log local0. "No Client Certificate
Provided - IP:[IP::client_addr]"
drop
}
else {
log local0. "Client Certificate Recieved
- IP:[IP::client_addr] Serial:[X509::serial_number [SSL::cert 0]]"
if { [class match [X509::serial_number
[SSL::cert 0]] equals ncf-tls-poc.443-ValidCertificateSNs] } {
log local0. "Client Accepted -
IP:[IP::client_addr] Serial:[X509::serial_number [SSL::cert 0]]"
}
else {
log local0. "Client Rejected -
IP:[IP::client_addr] Serial:[X509::serial_number [SSL::cert 0]]"
reject
}
}
}
