For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Apr 12, 2011

Client SSL Profile Chain

Hello all,

 

 

Scenario: BIP-IP version 9.4.4. New VS, x.x.x.x:443. SSL termination on f5 using Client SSL profile. I created a self signed SSL certificate on the f5 and this was issued by our own Certificate Services. I downloaded the certificate / key and, seperately, the certificate chain to the f5 (Local Traffic - SSL certificates). In a new Client SSL profile I associated the certificate and key and also, in the Chain bit, referenced the chain I downloaded. When users connected to the VS the connection would time out and never get to the website. The fix was to change the chain to None. The website then worked, allbeit with a certificate error as the issuer isn't trusted.

 

 

Also, using tcpdump I could see the 3way handshake complete.

 

 

My hope / desire was the self signed certificate would be trusted by anyone connecting to the VS because it would download the Chain to their client - as specified in the ssl client profile, saving them a prompt to "continue to the website".

 

 

Have I misunderstood the use of the Chain setting? Or have I misconfigured something my end?

 

 

Any help greatly appreciated.

 

 

N

 

config
design

2 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Apr 12, 2011
    A chain certificate (Or chain list) is only alink between the site certificate being presented, and a trusted certificate in your browser... Presenting the same cert as site and chain simply means nothing more than just presenting the cert itself. You still don't have a chain of trust to follow.

     

     

    To have a SS cert trusted, you have to install the SS cert into the CA cert list of a browser. WHich is a pain if you have a lot of them. Other options are to generate a local CA cert and install that as a CA cert in your browsers, and then use that to sign the certs you're generating... But that means you have to run a CA repository... And that means extra security, management etc...

     

     

    YMMV whether it's worth it or not.

     

     

    H
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Apr 12, 2011
    Hamish

     

     

    Thanks for clearing that up. It's only going to be a few external clients connecting so I'll ask them to install the cert manually.

     

     

     

    Rgds

     

    N