F5 SSL Everywhere

RECOMMENDED PRACTICES
F5 SSL Everywhere
How all the clients got their certificates is a management problem all in itself. Typically all
the clients are members of a well-funded organization (like a branch of the military) or Wall
Street traders, for instance. And often the certificates reside on smart cards or other
devices where they are accessed over public key cryptography standard (PKCS) protocol
#11.
Part 8 of the DevCentral series on SSL profiles provides a detailed breakdown of exactly
how client certificate authentication works within the TLS handshake.
Historically, the most common intersection of client certificate authentication and the F5
platform occurs in SSL termination and SSL bridging modes: the BIG-IP device is acting
as the SSL server to a client on the Internet and authenticating that client’s certificate. The
back-end servers, which trust the BIG-IP system, need to get information about the client
certificate. There are three ways to forward that client certificate information to the servers:
• X509 extraction
The oldest trick (and still one of the easiest) is to extract and insert fields from the
client certificate’s X509 directory information into the underlying HTTP stream as
headers. A typical iRules script might include gathering the issuer of the client
certificate and then inserting it into the HTTP request to the server as “F5_CLIENT_
ISSUER=[X509::issuer [SSL::cert 0]]”. See this DevCentral post for a more complete
example.
• X509 whole certificate extraction
A similar method is to extract and insert the entire certificate itself into the HTTP
stream as a multi-line PEM-encoded header. Obviously, the server-side code will
have to reassemble the certificate. The server can do the reassembly using a code
library or by executing the openssl x509 command. The iRules script to do this on
the BIG-IP device would look as simple as:
when HTTP_REQUEST {
if { [SSL::cert count] > 0 } {
HTTP::header insert “F5CC” [X509::whole [SSL::cert 0]]
}
}
• ProxySSL mode
There is a way to forward client certificates directly to the back-end server with a
special F5 SSL setting called proxySSL mode. With proxySSL, the BIG-IP device
must use the same certificate and key as the back-end server. Clients can then
connect all the way through to the server and authenticate with their certificates.
20