Forum Discussion

dirken's avatar
dirken
Icon for Nimbostratus rankNimbostratus
Jun 06, 2017

Client cert auth not working on Win2016

My VS has a client ssl profile bound, requiring client authentication and sending the required PKI to the client, which is a Win2016 server.   - Client Cert: require   - Trusted CAs:   - ...
application delivery
LTM
Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account

Greetings Dirken,

 

I have no background with Windows server, but let me offer some background on BIG-IP, there may be some overlap in behavior?

 

If you wish to have a server-ssl profile to send a certificate, you must also include the key.

 

If you wish to have a client-ssl profile send a certificate you must:

 

  • Import the certificate and key.
  • Associate the certificate and key with the client-ssl profile.
  • Associate the profile with a virtual server.

So in summary, perhaps try importing the accompanying key and ensure whatever service (IIS?) is configured to reference the certificate and key.

 

Good luck, hope you get this resolved soon!

 

Kevin

 

Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
Jun 06, 2017

Hi Dirken,

 

"the server side is fine, my problem is the client side. The clients connecting to the VS, however, are Windows2016 servers - maybe this created a bit of confusion."

 

No, that's what I was expecting (Server on client side of BIG-IP). Just to reiterate, when BIG-IP is in the position of your Win2016 server, it will not send a client certificate without the key. It needs both. I'm wondering if that's your problem. Maybe an SSL standard, just a shot in the dark. Also, what service on the Window2016 server is making the connection? IIS or which one? Does it need to reference this key pair?

 

Lastly, BIG-IP could not pass client certificates when configured to terminate SSL for the longest time. We finally implemented two different SSL proxies and they are able to do this. I wonder if your Windows server has a SSL proxy feature?

 

Kevin