Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Apr 09, 2012

2-Way SSL issue on v11.1

I have box that I upgraded from v10.2.0 HF 2 to v11.1 HF 2, and now all the applications that have server side 2 way ssl are not working. I have a case open with support to look into this, but I thought I would see if anyone has any suggestions. I have turned off re-negotiation so that should not be the issue. It appears that when I look at the ssldump that after the ServerHelloDone I see the ASM send a RST. I have 4 applications that connect to different web servers on the back end that perform 2 way ssl (client cert auth) and none of them are working so something is wrong with the configuration. Has anyone had any experience with this?

 

config
design

2 Replies

Sort By
  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2012
    Hi Mike,

     

    I have come across a similar sort of issue and what i have found up to now is that the uploaded ssl.crt and ssl.key are missing from the folder where they should be listed why this is happening I have no idea but i believe this is the main reason this problem is happening let the support help you in this I am also waiting for them to revert back to me and help me out.

     

     

    Regards,

     

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Apr 14, 2012
    mine is 11.1.0. i do not configure trusted certificate authorities in serverssl profile since i think it might not be relevant. 

    root@ve1110(Active)(/Common)(tmos) show sys version

Sys::Version
Main Package
  Product  BIG-IP
  Version  11.1.0
  Build    1943.0
  Edition  Final
  Date     Sun Nov 20 18:27:50 PST 2011

root@ve1110(Active)(/Common)(tmos) list ltm virtual bar
ltm virtual bar {
    destination 172.28.19.252:443
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        clientssl {
            context clientside
        }
        myserverssl {
            context serverside
        }
        tcp { }
    }
    snat automap
    vlans-disabled
}
root@ve1110(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        172.28.19.79:443 {
            address 172.28.19.79
        }
    }
    min-active-members 1
}
root@ve1110(Active)(/Common)(tmos) list ltm profile server-ssl myserverssl
ltm profile server-ssl myserverssl {
    app-service none
    cert client.crt
    defaults-from serverssl
    key client.key
}

 accessing pool member directly

[root@ve1110:Active] config  curl -Ik https://172.28.19.79
curl: (35) error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

[root@ve1110:Active] config  curl -Ik https://172.28.19.79 --cert /var/tmp/client.crt --key /var/tmp/client.key
HTTP/1.1 200 OK
Date: Sat, 14 Apr 2012 07:40:21 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 11 Nov 2011 14:48:14 GMT
ETag: "4183e4-3e-9c564780"
Accept-Ranges: bytes
Content-Length: 62
Content-Type: text/html; charset=UTF-8

 accessing virtual server

[root@ve1110:Active] config  curl -Ik https://172.28.19.252
HTTP/1.1 200 OK
Date: Sat, 14 Apr 2012 07:40:37 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 11 Nov 2011 14:48:14 GMT
ETag: "4183e4-3e-9c564780"
Accept-Ranges: bytes
Content-Length: 62
Content-Type: text/html; charset=UTF-8