Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

awan_m's avatar
awan_m
Icon for Cirrostratus rankCirrostratus
2 years ago

Client Authentication with Proxy SSL

Hello - i have the following setup 

Virtual server on the F5 without Client SSL or server ssl profiles - which passes web traffic to the backend iis server.

the IIS server is configured to require the client certificate for Client Authentication. 

Question - if i configure client ssl and server ssl on F5 with Proxy ssl enabled - will the F5 pass the clients certificate to the backend IIS server?

Thanks 

5 Replies

    • awan_m's avatar
      awan_m
      Icon for Cirrostratus rankCirrostratus
      2 years ago

      Thanks - i will test it out and update this .

      • Kevin_Stewart's avatar
        Kevin_Stewart
        Icon for Employee rankEmployee
        2 years ago

        To be clear, there are generally two options for allowing mutual TLS to pass through the BIG-IP, with client/server SSL profiles applied:

        • ProxySSL - as described above. But note, ProxySSL can only work with non-perfect-forward-secret handshakes. That means it only works with RSA handshakes, and never with ECC, DHE, ECDHE, ECDH, etc. And since RSA handshakes have been mostly deprecated by all modern browsers, this option isn't terribly useful unless you control the browsers and are willing to force significantly weaker encryption.
        • Client Cert Constrained Delegation (C3D) - https://my.f5.com/manage/s/article/K14065425. This is the modern way to handle the requested scenario, and works with TLS1.3 and below with modern ciphers.