For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tom_Schaefer's avatar
Tom_Schaefer
Icon for Cirrus rankCirrus
Aug 09, 2019

Connecting to invalid Server with SERVERSIDE SSL

I must be reading the documentation wrong. I am trying to ensure a connection to an external TLS server has a valid CA and a valid certificate. I have a virt with a SERVER SSL profile that sets drop ...
application delivery
iRules
LTM
Tom_Schaefer's avatar
Tom_Schaefer
Icon for Cirrus rankCirrus
Aug 13, 2019

Thanks. That is a problem as I have a single virtual server for outbound https servers. I use an iRule to select the profile and set the host name. I was hoping to not have to create a separate profile for each remote host I want to connect with. It sounds like that is not an option.

 

If I had the ability to dynamically set the Authenticate Name in an iRule, that would help.

 

I will say it was not obvious that the Invalid and expired options were dependent upon the Server Certificate being set to require.

 

Thanks for the assistance.

JG's avatar
JG
Icon for Cumulonimbus rankCumulonimbus
Aug 13, 2019

I simplified a bit. In other words, "Authenticate Name" must be covered by the certificate sent by the app server.

 

When F5 connects out, it needs to verify the authenticity of its peer by validating the certificate it receives from the app server.