Forum Discussion

SNz_298769's avatar
SNz_298769
Icon for Nimbostratus rankNimbostratus
Nov 10, 2016

serverssl for some reason is not working

hello,

 

I have a webserver application that cannot yet support SSL offloading and we need to configure Serverside SSL.

 

  1. I have an iis webserver with a certificate installed and working with https (port 447).
  2. I created and ssl profile mycert_profile that inherits from serverssl profile and under server authentication for Server Certificatehave selected required.
  3. Created a pool with node:447
  4. Created a vip HTTPS (443). Added the default http profile and under server certifcate selected the serverssl cert i created. selected the pool.

Am i missing something because for some reason it is not working. Any guidance at the earliest is highly appreciated. Shows website took too long to load. check settings

 

application delivery
BIG-IP
LTM

4 Replies

Sort By
  • David__Pasch_24's avatar
    David__Pasch_24
    Icon for Nimbostratus rankNimbostratus
    Nov 10, 2016

    Does it work with the default sslserver profile?

     

    Did you put a value in the Authenticate Name field when requiring authentication?

     

    If you select Require as the Server Certificate setting, you must also specify a value in the Authenticate Name setting. A blank Authenticate Name setting indicates that all servers are authenticated, even though you have specified Require as the Server Certificate setting.

     

  • SNz_298769's avatar
    SNz_298769
    Icon for Nimbostratus rankNimbostratus
    Nov 10, 2016

    I have also tried with default sslprofile. with ignore. with the same result.

     

  • SNz_298769's avatar
    SNz_298769
    Icon for Nimbostratus rankNimbostratus
    Nov 10, 2016

    For the autenticate name - i had put in fqdn name. The cert is a wildcard

     

  • Leonardo_Souza's avatar
    Leonardo_Souza
    Icon for Cirrocumulus rankCirrocumulus
    Nov 10, 2016

    I think there is misunderstanding about client authentication. Also, your configuration is missing a client ssl profile, and because you are using a HTTP profile that is never going to work.

     

    Looking the connection between the F5 and the backend server, F5 is the client and backend server the server. Majority of SSL/TSL connections don't use client authentication, so unless you need a certificate in your pc when you connect directly to the server, you don't need to do client authentication in the server ssl profile.

     

    Resuming, add a client ssl profile that has the same certificate and key that the server uses, use the default server ssl profile (no configuration needed for this profile).

     

    If you have a HTTP profile, the F5 must be able to decrypt the traffic to see HTTP data before it opens the server side connection. In your case, F5 only sees encrypted data, and never opens the server side connection.

     

    If you still have problems with a client ssl and server ssl, remove HTTP/clientssl/serverssl profiles. With this configuration, the SSL handshake is between the client and the backend server. So, you can verify if there is any other problem like networking. Also, if you don't need to manipulate the HTTP data, like using cookie persistence, a configuration without these 3 profiles is a valid setup, with the advantage that changes to certificate does not requires change to F5 configuration.

     

    If you want understand more about how this works, read this article:

     

    https://devcentral.f5.com/articles/ssl-profiles-part-1