F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

ic3man1986_2846's avatar
ic3man1986_2846
Icon for Nimbostratus rankNimbostratus
Apr 09, 2017

Big IP proxy ssl feature question

Hi guys,   i´ve a question to the proxy ssl feature.   I had a virtual server, with a client and a server certificate. Both have the proxy ssl feature enable. Think it works fine. I´ll could au...
application delivery
BIG-IP
LTM
security
dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
May 18, 2017

Hi,

 

Be aware that Proxy SSL makes not much sense those days. Most of the ciphers used (especially DH) are breaking this functionality - BIG-IP is not able to decrypt traffic.

 

Except some very special requirements when you have to ensure that BIG-IP is able to decrypt there is no point in using Proxy SSL, just let SSL traffic to go through BIG-IP encrypted.

 

If you have to let BIG-IP decrypt traffic then you have to assure that your backend server will accept only ciphers that allow decryption on BIG-IP = rather ancient and not very safe ciphers.

 

Piotr