Doing mTLS Authentication per URL
A customer asked if F5 supports mTLS Authentication per URL because some firewall vendors do not support this use case. At first, I thought it seems not possible because mTLS works at the lower OSI level before the URL is seen at OSI L7. A college suggested that it should be possible to decrypt the TLS, check the URL and then do the mTLS authentication when needed. Apparently, there are couple of simple iRules we can use to fulfill the requirement which is to do mTLS authentication based on certain URL.
Here is a simple iRules in need based on https://clouddocs.f5.com/api/irules/SSL__cert.html :
when HTTP_REQUEST {
if { [HTTP::path] eq "/sensitive_url" } {
if { [SSL::cert count] > 0 } {
if { [SSL::verify_result ] == 0 } {
# Good mTLS result, exit from this check
return
} else {
set error_string [X509::verify_cert_error_string [SSL::verify_result]]
}
} else {
set error_string "No client certificate provided"
}
# If we are still executing this iRule, the client did not present a cert or did not present a valid cert
HTTP::respond 403 content "<html>Invalid client certificate: $error_string</html>"
}
}
We have to expect that the client might come without the TLS certificate when accessing non-sensitive URL. To accomodate this condition, we have to adjust the Client-SSL profile attached to the VS to allow clients without client SSL certificate. We can select the "request" option on Client Certificate of the Client Authentication section inside the Client SSL profile.
That is all needed to fulfill the requirement of mTLS Authentication per URL. You can adjust the iRules to check the URL against a datagroup if there are multiple URLs to be authenticated. You also might want to reduce the error message to minimum in order to avoid attackers interpreting their mistake by not giving the right client SSL certificate.
Let me know your thoughts by leaving your comments below.
