Hi Martin,    There seems to be a unicode character after '$serial =', can you copy that to a notepad (or similar) and then copy/paste it back to the rule or copy the following:    $issuer = ssl.clientCertIssuer(); $serial = ssl.clientCertSerial(); if($issuer != "ROOT_CA" && $serial != "AABBCCDDEE1122334455667788" ) { http.sendResponse( 403, "text/html", "Forbidden","" ); }     By the way, the clientCertSerial() doesn't contain spaces.  Yousaf ... View more