Forum Discussion

Jean_Mamène's avatar
Jean_Mamène
Icon for Cirrus rankCirrus
Jun 26, 2023

double authentication with check CN serial number and certificate authority

Hello,

We have version 16 of BIG-IP LTM.
We have a virtual server on which several urls of the same domain are defined and which sends requests to the same pool of servers. On this virtual server and for a specific URL, we need double certificate authentication. Only a certificate should authorize the connection to the server pool. We want to check that the Common Name, Serial Number and Certificate Authority are correct to identify the certificate.

Example:
The virtual server "example.com" has the following URLs defined:
- url1.example.com
- url2.example.com
- url3.example.com
- url4.example.com with double authentication

Client certificate:
- CommonName = url4.example.com
- serial_number = 0123456789abcdef
- certificate authority = MyCertificateAuthority

I wanted to know if it was possible to set the URL with double authentication on the same vhost as the other URLs or if it should be set on a new virtual server.
In the 2 cases, what configuration should be set up to solve this problem?

Best regards.

security

6 Replies

Sort By
  • Jean_Mamène's avatar
    Jean_Mamène
    Icon for Cirrus rankCirrus
    Jul 07, 2023

    Hello,

    I'm back to give you some news.
    We have created a specific vhost for testing purposes and so as not to impact the other services hosted on the shared virtual servers.
    The irule for verifying the CN and serial number of the certificate is up and running (validated by the customer).
    We'll now look at configuring the SSL client profile.

    Best regards.

    • CA_Valli's avatar
      CA_Valli
      Icon for MVP rankMVP
      Jul 11, 2023

      Thanks for the feedback! Let us know if we can help you further in configuring this 😉

    • LiefZimmerman's avatar
      LiefZimmerman
      Icon for Admin rankAdmin
      Jul 14, 2023

      Jean_Mamène,

      If your original issue was resolved please choose Accept As Solution on one (or more) replies.

      This helps other members find answers more quickly and confirms the efforts of those who helped.
      Thanks for being part of our community.
      Lief

  • Jean_Mamène's avatar
    Jean_Mamène
    Icon for Cirrus rankCirrus
    Jun 29, 2023

    Hello,Thank you for your feedback.
    Daniel_Wolf, I'll be more careful next time about the vocabulary used.
    I'm currently running tests and I'll get back to you to confirm that it's working properly.

  • CA_Valli's avatar
    CA_Valli
    Icon for MVP rankMVP
    Jun 27, 2023

    Hello Jean_Mamène ,

    It should be possible to have this work on the same VIP, theorically.
    To configure client authentication, You need to build a clientSSL profile and configure it for the specific SNI "url4.example.com", and enable client authentication with "require" setting on this same profile. You should import the trusted CA that singed this certificate on BIG-IP
    https://my.f5.com/manage/s/article/K13452
    https://my.f5.com/manage/s/article/K12140946

    Next step is verifying client-certificate informations (SN, etc.) at authentication time. This can be achieved via iRule.
    You can get ideas from this code here, and tune it to check/match the requirements of your deployment. 
    https://clouddocs.f5.com/api/irules/ClientCertificateCNChecking.html