Forum Discussion

Livius's avatar
Livius
Icon for Cirrus rankCirrus
Sep 01, 2020

CSR instead of real certificate in SSL client profile

Hi guys,

 

I recently have seen at a customer a SSL profile which was referencing a certificate signing request and key + CA rather than the real certificate.

While this seems strange, my question is if is there any impact in the functionality in having a CSR + root CA rather than the real one?

application delivery
BIG-IP
  • David_M's avatar
    David_M
    Icon for Cirrostratus rankCirrostratus
    Sep 01, 2020

    and this is working fine? how will the client see the CN and get the public key and check for cert validity and stuff like that?

  • Bryan_T_'s avatar
    Bryan_T_
    Icon for MVP rankMVP
    Sep 01, 2020

    It's should be a signed public key certificate, not a CSR in the client profile. I'm surprised the BigIP even let this happen.

  • Livius's avatar
    Livius
    Icon for Cirrus rankCirrus
    Sep 01, 2020

    It shows "RSA Certificate, Key & Certificate Signing Request" whereas other certificates show only "RSA Certificate & Key". Does that actually mean that the CSR was generated on the LB itself?

      • B_S's avatar
        B_S
        Icon for Nimbostratus rankNimbostratus
        Jul 11, 2023

        Hi Bryan,

        I have the same situation, showing me "RSA Certificate, Key & Certificate Signing Request" for a specific certificate. I have no other Content like that on our LB but only "RSA Certificate, Key " . What I've done was just to renew a certificate which was going to expire, sent it to be signed by our PKI and import the new certificate. I don't understand why the CSR is still there and how can I get rid of it. Is this happening because something wrong on my side when I generated the CSR or by my colleague who signed the certificate on PKI?

         

        Thank you!