Forum Discussion

smilanko_261688's avatar
smilanko_261688
Icon for Cirrus rankCirrus
May 11, 2016

Configuring F5 Re-Encryption

I think at this point, I have looked at every guide ever created on this domain, and am rather stumped to what is causing my configuration to fail. Here is a bit of background:   I have a tomcat s...
application delivery
BIG-IP
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
May 11, 2016

It would seem that all indications are pointing to the server side SSL connection, and there are a number of things that can cause a failure. At the very least you should set up an SSLDUMP between the BIG-IP and Tomcat server and watch that transaction. If there's an SSL handshake error, you'll see it in this capture.

ssldump -AdNn -i [internal VLAN name] port 8443 [and any additional filters]

Also consider the following:

  1. It could be that the server doesn't support RFC5746 Secure Renegotiation. You'll actually see this in the LTM log, and you can control it by setting the Secure Renegotiation option in the BIG-IP's server SSL profile to Request.

  2. It could be that the server doesn't support the ciphers and/or protocols presented by the BIG-IP. This one is a bit more complex to troubleshoot, but if this is the case you'll likely see the server send an alert message directly at the client's (BIG-IP's) ClientHello message. Take note of the ciphers used by your successful direct connection test and compare those to what the BIG-IP is sending.

  3. It could be that the server requires a Server Name Indication (SNI) value. By default the server SSL profile doesn't send an SNI in the ClientHello, but you can add one in the Server Name field in the server SSL profile. This will usually also fail after the client's ClientHello message.