Certificates implementation in "SSL forward proxy client and server authentication" scenario.

The problem is sort of a paradox. You need to known when to decrypt and when not to decrypt based on the request, but you can't know that without decrypting first. There are a few less-than-optimal options:

1. If you can base all decisions on IP addresses (OSI layer 4), then you could either enable/disable SSL based on client source or have two separate destination VIPs with different SSL characteristics.

    

2. The TLS protocol offers an attribute in unencrypted handshake data, the "servername" value, that can be used to make routing decisions. This gets tricky because 1) beyond the handshake you have to maintain some form of persistence, and 2) not every client will support TLS.

    

I would also add, as I mentioned before, that not offloading the SSL at the proxy will put you at some disadvantage. SSL throughput on a BIG-IP device will almost always be MUCH higher than that of a commodity server, offloading SSL gives you the ability to enforce stronger client authentication and cipher control than you can usually get from a typical web server, and without access to the unencrypted HTTP payload at the proxy, you lose HTTP-based iRules, layer 7 optimization, cookie persistence, etc. Perhaps a better approach is to think about the many ways the F5 device can be used to proxy authentication instead of pass it through.

Kevin - i think we didn't understand correctly here. I can make decryption on the client side - this is not a problem. The main question here is the F5 can act as a client for the server it will connect and use client cert to authenticate ? So 2 servers will connect to the F5 VIP (HTTPS will be included, no client cert auth, SSL Offloading will occur). Then F5 will establish new HTTPS session (with client auth cert) to the server and send the requests there from the 2 servers. As i know how to offload the client site i don't see anything regarding client cert auth on the server side (profile). So the question here is - if it's possible to use client cert auth on the server side (one client cert will be provided for the F5) ? Many thanks for any info on that.

You can definitely put a client cert (and private key) in a server SSL profile, just not the client cert passed from a client to the VIP (if offloading SSL on the client side). To add a client cert and private key on the server side, import the cert and key and specify them in the Certificate and Key sections of the server SSL profile.

Hi.

How can use my "Oracle Http Server" certificates (auto login wallets) in ASM BigIP? How can import the auto login wallets to ASM BigIP?