For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mikegray_198028's avatar
mikegray_198028
Icon for Cirrus rankCirrus
Sep 01, 2016

client authentication certificate

Hello Team,

 

We have one application running on two IIS server with client certificate authentication. Could you please help me to loadbalance this and what modification required on client ssl profile.

 

application delivery
BIG-IP
LTM

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Sep 01, 2016

    Mike, you cannot terminate the SSL between the client and server if the server requires a client certificate. The client must digitally sign a piece of information and send that to the server during the handshake. A digital signore uses the sender's private key to encrypt, so if you decrypt and attempt to re-encrypt at a proxy, the proxy wouldn't have access to the client's private key.

     

    At a minimum, you'd have to switch into layer 4 load balancing mode, with no client or server SSL profiles, and nothing more than source address for persistence.

     

    You could optionally move the certificate authentication to the F5 with the Access Policy Manager module, and perform some other type of authentication to the backend web servers.