Forum Discussion

VishnuVG's avatar
VishnuVG
Icon for Nimbostratus rankNimbostratus
Jun 09, 2020

Client SSL profile based on uri

Hello team,

 

I have two client ssl profile one with client authentication and another without client authentication, can we select these profiles based on uri?

F5 OS version 14.1.2

 

I tried with iRule for SSL::cert mode request but the browser not requesting for the certificate.

 

when CLIENTSSL_CLIENTCERT {

set ssl_cert [SSL::cert 0]

}

when HTTP_REQUEST {

  if { [string tolower [HTTP::uri]] starts_with "/test" }

    { 

      HTTP::collect

      SSL::authenticate always

      SSL::authenticate depth 9

      SSL::cert mode request

      SSL::renegotiate

      HTTP::header insert clientcert "[IP::client_addr]:[TCP::client_port]: cert 0; subject=[X509::subject [SSL::cert 0]];[X509::issuer [SSL::cert 0]]; cert_serial=[X509::serial_number [SSL::cert 0]];"

    }

  }