Forum Discussion

soymanue's avatar
soymanue
Icon for Nimbostratus rankNimbostratus
Apr 20, 2010

SSL Certificate iRule with Hudfilter error

Hello I have a virtual server with ssl profile and one iRule to authenticate through SSL Cert when certain link is selected (i used one example found in devcentral).

 

You can find the iRule in the attached file.

 

 

I get this error continiously:

 

 

 

Apr 20 09:02:38 local/tmm3 err tmm3[3085]: 01220001:3: TCL error: SSL_CARD - Error: SSL hudfilter not reached or not in chain (line 1) invoked from within "SSL::cert count" peer expression (line 3) invoked from within "clientside { HTTP::header remove "WL-Proxy-Client-Cert" if { [SSL::cert count] > 0 } { HTTP::header insert "WL-Proxy-Client-Cert "..."

 

 

Apr 20 09:02:40 local/tmm1 err tmm1[3083]: 01220001:3: TCL error: SSL_CARD - Error: SSL hudfilter not reached or not in chain (line 1) invoked from within "SSL::cert count" peer expression (line 3) invoked from within "clientside { HTTP::header remove "WL-Proxy-Client-Cert" if { [SSL::cert count] > 0 } { HTTP::header insert "WL-Proxy-Client-Cert "..."

 

 

Apr 20 09:02:43 local/tmm err tmm[3082]: 01220001:3: TCL error: SSL_CARD - Error: SSL hudfilter not reached or not in chain (line 1) invoked from within "SSL::cert count" peer expression (line 3) invoked from within "clientside { HTTP::header remove "WL-Proxy-Client-Cert" if { [SSL::cert count] > 0 } { HTTP::header insert "WL-Proxy-Client-Cert "..." I'm absolutely lost Thank you
application delivery
dev
devops
iRules

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Apr 20, 2010
    Hi Manuel,

     

     

    Do you have "non-SSL" enabled on the client SSL profile attached to the virtual server? Are you able to reproduce the error when testing to the VIP? If so, are you making an HTTPS request?

     

     

    Aaron
  • soymanue's avatar
    soymanue
    Icon for Nimbostratus rankNimbostratus
    Apr 20, 2010
    Hello

     

    Non-SSL is disable.

     

    I'm not sure if the request is not SSL, because the connections that are producing these events come from external custumers.

     

    Anyway, we are not publishing non-SSL services. There is a virtual server that redirects http to https.

     

    Once you are connected to the ssl service with a certificate by Verisign, you may authenticate with user and password or choose an option of Certificate Authentication. This certificate is different, comes inside the Identity Card that our government issues.

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Apr 20, 2010
    The error seems to indicate that a client has made a non-SSL connection to the SSL enabled VIP (like http://1.1.1.1:443/ where 1.1.1.1 is the VIP). I'm not sure what would cause this error if you don't have non-SSL allowed on the client SSL profile. You could try opening a case with F5 Support to get help troubleshooting this.

     

     

    Aaron