Debugging ServerSSL Profile Setup

So I have a setup which basically is as follows:

F5 LTM (terminates external https traffic) this needs to re-encrypt to a NGINX server, which is setup to passthrough traffic to a HA Proxy service which also passes through to an Openshift setup, of which potentially multiple applications are accessible - inside the HA Proxy/Openshift these are all registered to a wildcard DNS - eg *.openshift.test, and all this resolves to the HA Proxy virtual IP.

So from the F5 cmd line, I can issue a simple curl cmd specifying the appropriate cert (as created within the Openshift env) which routes via the NGINX server and into HA Proxy and connects fine. Example curl --cacert ca-ocp.pem https://app1.openshift.test - where I have created a entry in the F5 host file for app1.openshift.test to map to the NGINX server IP address.

The NGINX config is a simple stearm defined one which listens on port 443 and routes to the HA Proxy IP address (as defined by *.openshift.test).

The above proves the routing/firewalls etc are all in place from the F5 downtream.

Now onto the issue I am encountering. I have a defined external URL which has a valid cert/etc - all verified by SSLshopper. The virtual server definition on the F5 has a clientssl profile (for the external cert) and a serverssl profile - this contains the cert used above (ca-ocp.pem). The pool which the VS uses has the IP address for the member which is the IP address of the NGINX server, now I am aware that this could be a potential problem as the IP address used here would not match the expected CN name of the application defined in Openshift. A health monitor on the pool (simple https one) works and the pool shows green. However, I can not get any connection working from the external URL through the F5 and onto the NGINX/HAproxy/Openshift.

I have created an iRule to log various events to see how far the F5 processes the request before it fails... and what I am seeing is the following:

• FLOW_INIT
• CLIENT_ACCEPTED
• CLIENTSSL_CLIENTHELLO
• HTTP_REQUEST
• LB_SELECTED
• LB_FAILED

I have SERVER_CONNECTED/SERVERSSL_CLIENTHELLO_SEND/SERVERSSL_SERVERHELLO/SERVERSSL_HANDSHAKE also defined in the iRule but these events are never triggered.

I have to admit using serverSSL profiles is completely new to me and so I am struggling to find out what is the root of the problem. The error logging for this type of issue seems to be non-existent, so I am in the dark as to where the problem lies, but I am sure (to the extent of my limited knowledge here) that is in the area of the serverSSL profile definition.

Any pointers as to how to troubleshoot this further would be useful! Many thanks!