For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

John_Ogle_45372's avatar
John_Ogle_45372
Icon for Nimbostratus rankNimbostratus
Jul 21, 2014

Exchange 2013 SSL certificates ???

I had some questions regarding SSL certificates with an Exchange 2013 implementation. We are discussing the option of bringing in a consultant but I wanted to understand the implementation myself(for now).

 

1) If I am doing SSL bridging and I have three CAS servers, do I need four SSL certificates (SAN/UCC). One for the LTM VS and one for each CAS server?

 

2) Can I buy one SAN/UCC cert and just import it into every device? Pros/Cons? Is there a functional negative to installing the same private key on all the boxes?

 

Thank you,

 

6 Replies

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    Jul 21, 2014

    Unless you specifically configure your SSL Server profile to look at the CAS server cert, it isn't going to care what cert is on your CAS server. So yes, you could put the same cert in all places.

     

    In my deployment I use one cert with all the needed names on the LTM. On the CAS server I use certificates signed by our internal CA, with the machine name as the common name of the cert.

     

  • John_Ogle_45372's avatar
    John_Ogle_45372
    Icon for Nimbostratus rankNimbostratus
    Jul 21, 2014

    The company doesn't have an internal CA so I maybe it is best to get certs from their current CA? If so, I wonder I need to buy just one or four?

     

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    Jul 21, 2014

    Again, the F5 isn't going to care about the cert on the CAS server unless you specifically tell it to via the server ssl profile. You could use one cert, or if you have concern about having the private key everywhere, you could use self sign certs on the CAS servers. I think IIS will generate a self signed cert for you, or pretty much anything with openssl on it(including the F5) can do it.

     

  • John_Ogle_45372's avatar
    John_Ogle_45372
    Icon for Nimbostratus rankNimbostratus
    Jul 21, 2014

    Got it. The LTM just acts a client using the server ssl profile and will talk to whatever cert the CAS server is using.

     

    1) So if I go with a Verisign cert, I can just import the private key/cert combo onto all CAS servers, right? LTM has the Verisign root ca in it's bundle so no issue there.

     

    2) If I generate self-signed certs on the LTM then I need to export the private key/cert combo and import it on the CAS servers, correct?

     

    Thank you,

     

  • mimlo_61970's avatar
    mimlo_61970
    Icon for Cumulonimbus rankCumulonimbus
    Jul 21, 2014

    Correct on both accounts. If you export on the LTM, you will probably need to convert it to pkcs12 format for windows.

    openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

    you can run this from the F5 bash shell if you don't have openssl somewhere else.