F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP APM
  4. BIG-IP Access Policy Manager: Authentication and Single Sign-On
  5. Client Certificate Inspection
Manual Chapter : Client Certificate Inspection

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

About client certificate inspection

The Client Cert Inspection access policy item checks the result of the SSL handshake that occurs at the start of a session. It does not, however, negotiate an SSL session. It relies on settings in a client SSL profile that is added to the virtual server. The Client Cert Inspection item can provide the result of the SSL handshake, including certificate revocation status when the client SSL profile specifies a certificate revocation list (CRL).

Task summary for client certificate inspection

To complete this configuration, you need an access profile and a virtual server configured. Checking the validity of a client certificate is very likely to be one of many items you add to an access policy.

Task list

Creating a client SSL profile for certificate inspection

The BIG-IP system supplies a default certificate and a ca-bundle.crt file that includes all well-known public certificate authority (CA) certificates for client-side processing. Before you create a client SSL profile, you might want to configure a trusted certificate to use for client-side processing. To verify certificate revocation status, you must have obtained a certificate revocation list (CRL) and imported it to the SSL Certificate List.
You create a custom client SSL profile to request an SSL certificate from the client at the start of the session. This enables a Client Cert Inspection item in an access policy to check whether a valid certificate was presented.
  1. On the Main tab, click Local Traffic > Profiles > SSL > Client. The Client profile list screen opens.
  2. Click Create. The New Server SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. From the Parent Profile list, select clientssl.
  5. Scroll down to the Client Authentication area.
  6. Select the Custom check box for Client Authentication. The settings become available.
  7. From the Client Certificate list, select request. Alternatively, select require; however, if you do, the user must provide a valid client certificate or the connection is not allowed.
  8. Optional: If you imported a CRL, select it from the Certificate Revocation List (CRL) list. If you are using this client SSL profile in conjunction with an access policy that performs OCSP Responder authentication or CRLDP authentication, do not select a CRL.
  9. Click Finished.
To put this client SSL profile into effect, select it in a virtual server that is configured to accept HTTPS traffic.

Configuring an access policy to confirm client certificate validity

Add a client certificate inspection item to an access policy when you want to check whether the client presented a valid certificate at the start of the session.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. In the Access Policy column, click the Edit link for the access profile you want to configure. The visual policy editor opens the access policy in a separate screen.
  3. Click the (+) icon anywhere in the access policy to add a new action item.
    Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
    A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. In the search field type client, then select Client Cert Inspection from the results list, and click Add item. A popup Properties screen displays.
  5. Click Save. The properties screen closes and the visual policy editor displays.
  6. Complete the access policy:
    1. Add any additional access policy items you require.
    2. Change the ending from Deny to Allow on any access policy branch on which you want to grant access.
  7. Click Apply Access Policy to save your configuration.
To put an access policy into effect, add it to a virtual server.
Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information