Home / server / Questions / 1020160
Accepted
Alessandro
Asked: 2020-06-06 01:03:07 +0800 CST

SSL Renegotiation trigger - F5 iRule

  • 772

I'm trying to implement a TCL script to be used in an F5 iRule, in order to catch any SSL renegotiation event. I'm stuck at the first step, which is basically the "trigger" which could say "when the SSL renegotiation happens, do something" (e.g. log the event to the syslog).

My question is: Since the SSL connection is already established, what is the trigger that prompts the link to be re-established? How can I use this in an iRule?

Any help is greatly appreciated.

ssl f5-big-ip tcl

1 Answers

  1. Best Answer

    There isn't a specific event for renegotiate that I can see in the docs... However have you tried logging any CLIENT_HANDSHAKE or SERVER_HANDSHAKE events?

    It's not specifically mentioned that CLIENT_HANDSHAKE or SERVER_HANDSHAKE fire at renegotiation. but I notice that the following codeshare example for counting renege for DOS mitigation uses them..

    ssl-renegotiation-dos-mitigation

    • 1