Forum Discussion
Can I have multiple certificates for one VIP on LTM?
In general, you create an SSL virtual server, but assign multiple client SSL profiles to the virtual server. This tells the F5 that you want to check for SNI information in client requests. You need to create one client SSL profile per server name that will be used by your accessors, each configured with the appropriate certificate for that server name. You can either configure in explicitly the server hostname that will trigger use of that profile, or allow it to infer that hostname from the certificate you select (in 11.5.0 and earlier, it will use the Common Name field from the certificate you select, in later versions, it will use the first Subject Alternate Name value in the cert). One of these profiles should be declared as the default SNI profile (this profile will be used for any clients that connect that do not support SNI).
In the virtual server configuration, when you add multiple client SSL profiles, it triggers use of SNI, and on each request, the ClientHello packet will be examined for an SNI hostname - and if one is provided by the client, the client SSL profile with a matching hostname will be selected, and the certificate from that SSL profile will be provided to the client. If no SNI hostname is provided by the client, the client SSL profile marked as "default SNI" will be used, and the cert associated with that profile will be sent to the client.
That's a very general description of how it works - if you need more detailed steps on setting it up, pls identify what LTM firmware version you are using, and if possible what parts are not clear to you.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com