View source for Client Auth via PKI

[[Category:F5 Networks]]
'''[[F5 Networks#iRules|Back to iRules]]'''

 # add datagroup CertificateCA
 #String: DigiCert Server CA
 #Value: www.domain.com
 when CLIENTSSL_CLIENTCERT {
    set SubCN [findstr [X509::subject [SSL::cert 0]] "CN=" 3 ","]
    set IssCN [findstr [X509::issuer [SSL::cert 0]] "CN=" 3 ","]
    if {[class match $IssCN equals CertificateCA]}{
        set name [class match -value $IssCN equals CertificateCA]
             if {$name ne ""} {
                  if { $name eq $SubCN } {
                      } else {
                        reject
                      }
                  } else {
                     reject
                 }
     } else {
   }
 }