Manual Chapter :
Client Certificate Inspection
Applies To:
Show VersionsBIG-IP APM
- 15.1.10, 15.1.9, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3
Client Certificate Inspection
About client certificate inspection
The Client Cert Inspection access policy item checks the result of the SSL
handshake that occurs at the start of a session. It does not, however, negotiate an SSL session.
It relies on settings in a client SSL profile that is added to the virtual server. The Client
Cert Inspection item can provide the result of the SSL handshake, including certificate
revocation status when the client SSL profile specifies a certificate revocation list (CRL).
Task summary for client certificate inspection
To complete this configuration, you need an access profile and a virtual server
configured. Checking the validity of a client certificate is very likely to be one of many items
you add to an access policy.
Creating a client
SSL profile for certificate inspection
Before you start this task, import the CA certificate for VMware View Horizon server to
the BIG-IP system certificate store.
You create a custom client SSL profile to request
an SSL certificate from the client at the start of the session. This enables a Client
Cert Inspection item in an access policy to check whether a valid certificate was
presented.
- On the Main tab, click.The Client SSL profile list screen opens.
- ClickCreate.The New Server SSL Profile screen opens.
- In theNamefield, type a unique name for the profile.
- From theParent Profilelist, selectclientssl.The default settings for the profile specify a 10-second SSL handshake timeout. Some users with smart cards cannot authenticate within that time. You can increase the timeout if this is the case at your site.
- From theConfigurationlist, selectAdvanced.
- If you have VMware View clients on Mac OS X, disable TLS 1.2 in the Options List area:
- In theAvailable Optionslist, selectNo TLS 1.2.
- ClickEnable.
- If you change the values for theCache Sizeor theCache Timeoutsetting, do not specify a value of zero (0) for either setting.When these values are 0, the client must supply a PIN on each browser page refresh.
- Scroll down toHandshake Timeoutand select theCustomcheck box.Additional settings become available.
- To limit the timeout to a number of seconds, selectSpecifyfrom the list, and type the required number in thesecondsfield.In the list, the valueIndefinitespecifies that the system continue trying to establish a connection for an unlimited time. If you selectIndefinite, thesecondsfield is no longer available.
- Scroll down to the Client Authentication area.
- Next to Client Authentication, select theCustomcheck box.The settings become available.
- From theClient Certificatelist, selectrequest.Do not selectrequire.
- From theTrusted Certificate AuthoritiesandAdvertised Certificate Authorities, select the certificates you imported previously.
- ClickFinished.
Configuring an access
policy to confirm client certificate validity
Add
a client certificate inspection item to an access policy when you want to check whether the
client presented a valid certificate at the start of the session.
- On the Main tab, click.The Access Profiles (Per-Session Policies) screen opens.
- In the Per-Session Policy column, click theEditlink for the access profile you want to configure.The visual policy editor opens the access policy in a separate screen.
- Click the(+)icon anywhere in the access policy to add a new item.Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
- In the search field typeclient, then selectClient Cert Inspectionfrom the results list, and clickAdd item.A popup Properties screen displays.
- ClickSave.The properties screen closes and the policy displays.
- Complete the policy:
- Add any additional policy items you require.
- Change the ending fromDenytoAllowon any access policy branch on which you want to grant access.
- ClickApply Access Policyto save your configuration.
To
apply this access policy to network traffic, add the access profile to a virtual
server.
To ensure
that logging is configured to meet your requirements, verify the log settings for
the access profile.
Verify log settings for the access profile
Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.
Log settings are configured in the
area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations. - On the Main tab, click.The Access Profiles (Per-Session Policies) screen opens.
- Click the name of the access profile that you want to edit.The properties screen opens.
- On the menu bar, clickLogs.The access profile log settings display.
- Move log settings between theAvailableandSelectedlists.You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.Logging is disabled when theSelectedlist is empty.
- ClickUpdate.
An access profile is in effect when it is assigned to a virtual server.