For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Apr 12, 2011

Client SSL Profile Chain

Hello all,     Scenario: BIP-IP version 9.4.4. New VS, x.x.x.x:443. SSL termination on f5 using Client SSL profile. I created a self signed SSL certificate on the f5 and this was issued by our o...
config
design
Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Apr 12, 2011
A chain certificate (Or chain list) is only alink between the site certificate being presented, and a trusted certificate in your browser... Presenting the same cert as site and chain simply means nothing more than just presenting the cert itself. You still don't have a chain of trust to follow.

 

 

To have a SS cert trusted, you have to install the SS cert into the CA cert list of a browser. WHich is a pain if you have a lot of them. Other options are to generate a local CA cert and install that as a CA cert in your browsers, and then use that to sign the certs you're generating... But that means you have to run a CA repository... And that means extra security, management etc...

 

 

YMMV whether it's worth it or not.

 

 

H