Mathew_58739
Nimbostratus
NimbostratusSSL ClientCert validation
I have an iRule that I am attempting to write that will validate a client SSL certificate. If an error is found, log it and deliver a custom http::respond. I can get the http::respond to work all by itself. I can get the client certificate validation to work all by itself. But I cant get them to work together.
HTTP::respond by itself:
when RULE_INIT {
set response {
Certificate Deny
Your SSL MA connection was denied.
Please validate your certificate.
}
}
when HTTP_REQUEST {
HTTP::respond 520 content [subst $::response]
}
Client Certificate validation by itself:
when CLIENTSSL_CLIENTCERT {
set client_cert [SSL::cert 0]
if { [X509::subject $client_cert] contains "emailAddress" }{
log local0. "Failed STRATA SSL: [IP::client_addr] & [X509::subject $client_cert]"
reject
}
}
Combined:
when RULE_INIT {
set response {
Certificate Deny
Your SSL MA connection was denied.
Please validate your certificate.
}
}
when CLIENTSSL_CLIENTCERT {
set client_cert [SSL::cert 0]
if { [X509::subject $client_cert] contains "emailAddress" }{
log local0. "Failed STRATA SSL: [IP::client_addr] & [X509::subject $client_cert]"
set ::denycode 0
log local0. "DenyCode = $::denycode"
}
}
when HTTP_REQUEST {
if { $::denycode == 0 }{
HTTP::respond 520 content [subst $::response]
}
unset ::denycode
unset ::response
}
I can log the rule, and see it working all the way down to the "denycode" variable being created. Nothing below that. Any suggestions...??
