Forum Discussion

Anderson__Eric_'s avatar
Anderson__Eric_
Icon for Nimbostratus rankNimbostratus
May 04, 2011

Client Certificate & .NET

We have configured our LTM for client certificates and with a browser (IE, Chrome, FireFox, etc.) it works fine. (Client authenticates and then the serial is passed onto our web application). However, we're adding a twist to a new site and when it's called from our .NET client application (.NET app makes call to -> ), it bombs out. We have a stream defined to tranlates the WSDL for us. Found a couple of articles about the "client" and TLS/SCVS (http://stackoverflow.com/questions/...-not-confi), however, even though it matches the description, it does not resolve our issue.

 

 

Below is a copy of the message received by the client. If you're written a .NET app to use a client certificate (from your store) and connect to an F5, did you have to anything special? The .NET application, for simplicity sake, mimics the examples outlined in http://www.codeproject.com/KB/WCF/wcfcertificates.aspx.

 

 

 

ERROR:

 

This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server.

 

 

config
design
  • Anderson__Eric_'s avatar
    Anderson__Eric_
    Icon for Nimbostratus rankNimbostratus
    May 04, 2011

    Problem solved! Have to thank our developer Wilman. Long story made short, it's because the F5 is doing SSL offloading and the WSDL does not specify "certificate" in the security mode/transport section.

     

    In the transport change from:

     

     

     

    To:

     

     

     

     

     

     

     

     

     

     

     

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      May 20, 2018

      you might have more luck posting a new question (with clear description and full details) then replying on something 7 years old.

       

      anyway he changed something on the XML side, not on the BIG-IP i except: "WSDL does not specify "certificate" in the security mode/transport section."