# Checking client certificat using acl/map/host/cn

**URL:** <https://discourse.haproxy.org/t/checking-client-certificat-using-acl-map-host-cn/967>\
**Category:** Help!\
**Created:** [January 27, 2017, 4:45pm UTC](https://discourse.haproxy.org/t/checking-client-certificat-using-acl-map-host-cn/967 "2017-01-27T16:45:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharlee33](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@sharlee33](https://discourse.haproxy.org/u/sharlee33)\
**Post date:** [January 27, 2017, 4:45pm UTC](https://discourse.haproxy.org/t/checking-client-certificat-using-acl-map-host-cn/967/1 "2017-01-27T16:45:40Z")

</div>

Hello,

I would like to check client certificat CN using a map file.  
This map file contains for each targeted hostname, the authorized CN list.

Test steps :  
a) 1st step, find the list of CN for the requested host, in the map file  
b) 2nd step, check the client CN in the list retrieved at a)

An example of authorized CN lists map file :  
$ cat /tmp/listCERT.checkcert  
#host CNs List (separated by /)  
[server1.xxx.com](http://server1.xxx.com) client0.zzz/client1.zzz/  
[server2.xxx.com](http://server2.xxx.com) client0.zzz/client2.zzz/

An extract of haproxy configuration file :

acl validcert hdr(host),map\_str(/tmp/listCERT.checkcert,nocerts) -m %[sub ssl\_c\_s\_dn(cn)]  
http-request deny if !validcert

But this acl configuration does not work ☹

Do you have any idea ?

thanks in advance 😉

regards,  
Sharlee33.