Forum Discussion

7 Replies

  • Plan is User --to-- F5 (SSL Cert) then F5 VIP ---> to Web Server without Cert (Http only) is this possible? I tried its not working. thank you!

     

  • This is the basic bread and butter for f5 - SSL offloading.

     

    Make sure you have a client SSL profile (with the correct certificate & key) assigned to your https virtual server, and your pool members have to have a destination port of 80.

     

    If this is still not working, maybe you can give us more details as to why it's not working. You must ensure that you have return routing via the f5, or use SNAT.

     

  • Emad's avatar
    Emad
    Icon for Cirrostratus rankCirrostratus

    F5 LTM is the best for Offloading SSL. You need to create a pool like of apache webservers running on port 80. Create a VIP on HTTPS/443 Port. Before that import your ssl certificate in LTM and create and ssl profile like www.abc.com. While creating VIP Select client certificate from available list. and thats it. :)

     

    This will help you. http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_0_0/ltm_ssl_profiles.html

     

  • very cool and page is loading using https:// offloading on f5 however there is an error. page loads different looks like CSS issue but when you check the cert it says "Your connection to website.com is encrypted with 128-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the look of the page. Is there a way to bypass these remarks on clients side by not clicking allow or exempt?

     

    • PeteWhite's avatar
      PeteWhite
      Icon for Employee rankEmployee
      This is probably because the server is redirecting to the http location. Use "redirect rewrite" set to "matching" in the http profile and this will change the redirect to be pointing at https. It is also possible to rewrite hardcode html links via streams profiles and rewrite profiles.
  • Emad's avatar
    Emad
    Icon for Cirrostratus rankCirrostratus

    Are u using any Self signed certificate or CA-Cert.? Have you loaded caroot certificate? Also It depends which environment you are running. what type of application you are running. is it Apache web server based or java based application ?