How to match custom SSL based applications

[apackard]

I'm trying to tag a particular application protocol that used TLS/SSL as a security wrapper.

The most accurate way I can ID this application protocol is to match against the FQDN subjectName returned by the server during the certificate handshake.

I've setup a custom App-ID configured as:-

Parent App: ssl

Port: tcp/443

Pattern Match: Context: ssl-rsp-certificate, Pattern: server\.domain\.com

but this isn't matching.  I've also tried using the Context type: ssl-rsp-server-hello and this too fails.

I have confirmed with a tcpdump that this string is present in the server response.

Any clues greatfully received!

[schiang1]

show session all filter source x.x.x.x destination y.y.y.y

What does the application get identified as?

Maybe try:

Pattern Match: Context: ssl-rsp-certificate, pattern server.domain\.com

[Sebbb]

Hi,

I have to solve the same problem : identifing an internal application using ssl certificate CN, but defining a custom application, overriding ssl app and matching ssl-rsp-certificate don't work.

Any other idea to use certificate CN to identify a web-based ssl application ?

Regards,

--

Sébastien B.

Soft ver. 3.1.4 and up-to-date app-thread pack.