Forum Discussion

ggarza_345867's avatar
ggarza_345867
Icon for Nimbostratus rankNimbostratus
Dec 10, 2018

client ssl profile to serverssl pool members each with different certificates

can I have a custom client side ssl profile and use then use the default serverssl profile to negotiate with 5 pool members each with different certificates? I need to encrypt end to end but the pool members use different profiles?

 

application delivery
LTM
security
  • rob_carr's avatar
    rob_carr
    Icon for Cirrocumulus rankCirrocumulus
    Dec 11, 2018

    The certificate offered by the clientssl profile and the certificates offered by the application servers don't have to be the same. Along with that, by default the serverssl profile doesn't verify certificates by default, so having different certificates on each of your application servers isn't necessarily an issue.

     

    If you do want to have certificate verification between the BIG-IP and the backend servers, it appears that you can only provide one set of trusted certificate authorities, so you will either need to have all server provided certificates chain to the same CA or use some method of profile switching to change the serverssl profile to match the selected back-end server.