Forum Discussion
Common name SSL F5
hello team,
I have a problem with a certification deployed on F5.
Currently this certification have the CN : lab1.mycompany.lan
So the problem is when i change the link of my application to lab2.mycompany.lan that use the profil of certification "CN:lab1.company.lan" i can access despite the web address is different.
At my knowledge, the Common Name must be the same as the Web address you will be accessing when connecting to a secure site
Could you please help me to solve this issue ?
If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.
None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.
However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452
- Vijay_ECirrus
So, lab2.mycompany.lan is using lab1.mycompany.lan certificate but you are seeing no errors ? If so, may be wild-card certificate or multiple domain certificate ? Did you check to make sure the traffic is flowing to the right resource ?
- Ilian_IvanovNimbostratus
Hello,
It is normal that you can access your site from different URLs, even it is SSL and you have only 1 CN. You can have a lot of DNS entries pointing to the same location. But if the certificate CN is lab1.mycompany.lan you will get certificate warning when you try with lab2.mycompany.lan. You can skip the warning and continue to the site.
If you want that site to be reached only from URL- lab1.mycompany.lan, you will need to use an iRule like that one:
when HTTP_REQUEST { if { [HTTP::host] equals "lab1.mycompany.lan" } { pool myhttppool } else { drop } }
- Ashwin_VenkatEmployee
If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.
None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.
However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452
- elamri_304806Nimbostratus
Thank you for your feedback
- Ashwin_Venkat_1Historic F5 Account
If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.
None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.
However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452
- elamri_304806Nimbostratus
Thank you for your feedback
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com