Forum Discussion
Misrosoft Direct Access SSL (IP-HTTPS) Offloading
Hi, I'm trying to configure SSL offloading with IP-HTTPS. I followed the guide written by Richard Hicks (https://directaccess.richardhicks.com/2013/07/10/ssl-offload-for-ip-https-directaccess-traffic-from-windows-7-clients-using-f5-big-ip/)
I'm getting an error message (No Certificate on gui under statistics and Handshake failures in the log)
The certificate is a public certificate of authority generated for the IIS server and imported separately cert, key, chain.
Do I need to create a certificate from a CSR generated on the F5 with the public chain and key for this to work?
Is there any other option I need to tick?
Your help is much appreciated,
Many thanks
Damir
1 Reply
If running auto discovery, you may be hitting a bug: https://cdn.f5.com/product/bugtracker/ID995029.html. What version of BIG-IP code are you running? Also, generally these settings are configured in concert with a 3rd party provider, or when you have access to the 3rd party configuration for OAuth.
- Lucas_Thompson
Employee
OAuth can be confusing to set up because it's fairly complicated and APM's implementation has a lot of options to interoperate with various 3rd parties.
The JWT refresh token encryption secret is the encryption key used to encrypt the JWT refresh token that APM generates and sends to the client. When the client comes back to get a new token from the refresh endpoint, it sends the refresh token. The refresh token (in APM) is an encrypted version of the original token. APM checks the encrypted token for validity, then recreates the original token based off the data provided from the refresh token. Then it encrypts another refresh token. In this way, APM actually does not hold state information about the session so the user could potentially use the refresh token against ANY similarly-configured BIG-IP APM.
The JWK is used by APM to cryptographically validate the JWT in the case of "internal validation mode" (it doesn't have to go hit the AS's introspect endpoint) of the OAuth Scope agent.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com