For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

NetWork's avatar
NetWork
Icon for Nimbostratus rankNimbostratus
Dec 09, 2020
Solved

F5 Device Administration/configuration - Vulnerabilities

Can someone help me to understand using self-signed certificate for BIGIP LTM box falls in non-compliant as long as our device will be accessed only by network administrators?
application delivery
BIG-IP
LTM
  • Lidev's avatar
    Lidev
    Dec 09, 2020

    Hi,

    Using self-signed certificates can pose a number of challenges, severals attacks have successfully exploited self-signed certificates (MitM attack, Drye Banking Trojan etc.)

    So, even if your device is only access by network administrators, it's not something to be advised (there's a risk if one of the admin account or admin access is compromised)

     

    A good article on this topic : When are self-signed certificates acceptable?

     

    Regards

Lidev's avatar
Lidev
Icon for Nacreous rankNacreous
Dec 09, 2020

Hi,

Using self-signed certificates can pose a number of challenges, severals attacks have successfully exploited self-signed certificates (MitM attack, Drye Banking Trojan etc.)

So, even if your device is only access by network administrators, it's not something to be advised (there's a risk if one of the admin account or admin access is compromised)

 

A good article on this topic : When are self-signed certificates acceptable?

 

Regards