Certificates implementation in "SSL forward proxy client and server authentication" scenario.

In most cases you don't need to do anything specific with the server SSL profile. This is the client side of the SSL handshake with the server, and will (unless instructed otherwise) blissfully ignore any subject or trust mismatches. So given that you have a generic environment that requires SSL termination on the client side to the F5, and re-encryption to the server, the following is an absolute basic requirement for this to work:

1. Client SSL profile - at a minimum you need the server certificate and private key that will be presented to the client during the client side SSL handshake. Unless you're also doing client certificate authentication, or mandating different cipher suites, you shouldn't need anything else configured in this profile.

    

2. Server SSL profile - in many cases the default serverssl profile is sufficient to re-encrypt the traffic to the back end. The server will present its certificate to the client (server SSL profile) during the SSL handshake, and the client will ignore the certificate mismatch and carry on. If you're running an older IIS or Apache instance, you may not be able to support the newer secure renegotiation capability, so you can either set the Secure Renegotiation option in the server SSL profile to "Request", or simply use the serverssl-insecure-compatible profile.

    

How can this be done via CLI? I can not post screen shots.

list ltm virtual VS-TESTVERINT-443 ltm virtual VS-TESTVERINT-443 { destination 172.29.243.27:https ip-protocol tcp mask 255.255.255.255 pool P-TESTVERINT-443 profiles { CSSL-TESTVERINT { context clientside } SSSL-SNVERAPP { context serverside } tcp { } } source 0.0.0.0/0 source-address-translation { pool VIP-TESTVERINT type snat } vlans-disabled }

list ltm profile client-ssl CSSL-TESTVERINT ltm profile client-ssl CSSL-TESTVERINT { app-service none cert-extension-includes none cert-lifespan 30 defaults-from clientssl proxy-ca-cert VERINT.EXT.VIDEOTRON.COM.crt proxy-ca-key VERINT.EXT.VIDEOTRON.COM.key proxy-ca-passphrase $M$q7$IQDtaQ4oZ2BXvIAqz5s2Bg== ssl-forward-proxy enabled }

list ltm profile server-ssl SSSL-SNVERAPP ltm profile server-ssl SSSL-SNVERAPP { alert-timeout 10 app-service none cache-size 262144 cache-timeout 3600 cert SNVERAPP3.EXT.VIDEOTRON.COM.crt chain none ciphers DEFAULT defaults-from serverssl handshake-timeout 10 key SNVERAPP3.EXT.VIDEOTRON.COM.key mod-ssl-methods disabled options { dont-insert-empty-fragments } passphrase $M$mF$IT/oLKnaCjrDzrPuNam/KA== proxy-ssl disabled renegotiate-period indefinite renegotiate-size indefinite renegotiation enabled secure-renegotiation require-strict server-name none session-ticket disabled sni-default false sni-require false ssl-forward-proxy enabled strict-resume disabled unclean-shutdown enabled }

Hi Alain, I would try the steps in the 11.5.0 manual. There is an error in the 11.3.0 manual that has been corrected. This step isn't necessary and has been removed:

Important: The certificate and key that you specify in this profile must match the certificate/key pair that you expect the back-end server to offer. If the back-end server has two or more certificates to offer, you must create a separate Server SSL forward proxy profile for each certificate, and then assign all of the Server SSL forward proxy profiles to a single virtual server.

This was some confusion here with another SSL Proxy feature. Essentially, you should only need the CA key and certificate to sign the newly created (on the fly) certificates.

Corrected guide:

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-5-0/16.html?sr=35921646

Hope this helps, Kevin

It sounds like you are doing reverse proxy, not forward proxy.

For your client SSL profile, you should only need to specify your certificate and key. Can you modify your client SSL profile to remove all other configurations than the certificate and key, and then retest?

If you are doing any kind of client certificate based authentication, then other options will need to be specified.

In real, the client hits the URL https://verint.ext.videotron.com and what I need to to be able decrypt end re-encrypt traffic from F5 to a load balanced pool of 2 servers using SSL. Those 2 backend servers are called snverapp1.ext.videotron.com and snverapp3.ext.videotron.com. The applications on those servers requires that conversations are encrypted via SSL.

Yes, this is definitely a reverse proxy scenario then. Change your client SSL profile to only specify the certificate and key, and then retest connectivity.

I followed the 11.5.0 procedure but I still have the same error. Here is my current config like posted before:

list ltm virtual VS-TESTVERINT ltm virtual VS-TESTVERINT { destination 172.29.243.27:http ip-protocol tcp mask 255.255.255.255 pool P-TESTVERINT profiles { CSSL-TESTVERINT { context clientside } SSSL-SNVERAPP { context serverside } http { } tcp { } } source 0.0.0.0/0 source-address-translation { pool VIP-TESTVERINT type snat } vlans-disabled }

list ltm profile client-ssl CSSL-TESTVERINT ltm profile client-ssl CSSL-TESTVERINT { app-service none cert-extension-includes none cert-lifespan 30 defaults-from clientssl proxy-ca-cert TESTVERINT.EXT.VIDEOTRON.COM.crt proxy-ca-key TESTVERINT.EXT.VIDEOTRON.COM.key proxy-ca-passphrase $M$Oy$plRYv/NIjd7CVO5FRnJGxA== ssl-forward-proxy enabled }

list ltm profile server-ssl SSSL-SNVERAPP ltm profile server-ssl SSSL-SNVERAPP { app-service none cert default.crt defaults-from serverssl key default.key ssl-forward-proxy enabled }

You are specifying forward proxy in your client SSL profile. For reverse proxy, it should look something like this:

ltm profile client-ssl CSSL-TESTVERINT {
    app-service none
    cert TESTVERINT.EXT.VIDEOTRON.COM.crt
    chain none
    defaults-from clientssl
    key TESTVERINT.EXT.VIDEOTRON.COM.key
    }

I thought the the SSL forward proxy implementation was the procedure I should use to have client (SSL) --> BIG-IP (SSL) --> backendserver (SSL) communication. At least, this is what the procedure https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-5-0/16.html?sr=35921646 is talking about. Please correct me if I'm wrong.