Forum Discussion
HTTPS Problem
Up until now using the F5 has been fairly straight forward. Adding HTTPS certificate support for incoming IE connections however has got me stumped. I have watched the online webinar and tried many variations to get it working without success.
What I am trying to do is to take a working HTTP connection through the F5 to a pool consisting of a pair of Tomcat servers and convert the virtual server connection from HTTP to HTTPS. Wireshark traces show the F5 and the Tomcat communicating with each other and all of the status balls are green. How do I go about debugging my problem? Where do I look to find out what is not happening?
Regards,
Mark
- jwham20NimbostratusMarkM,
- MarkM_63051NimbostratusFront side, client to F5. Not F5 to the balanced server in the pool.
- jwham20NimbostratusSweet! Alright, here's my favorite way to do it, everyone has a flavor of it I'm sure.
- MarkM_63051Nimbostratus
Hello Josh,
Thank you for the clear instructions. Unfortunately, no workie. I even created a new certificate using openssl. I get the following error "Internet Explorer cannot display the webpage". If I change the service port back to 80 and then remove the ssl client profile, then it works.
- jwham20NimbostratusMarkM,
- natheCirrocumulusMarkM,
- MarkM_63051Nimbostratus
Hello Nathan,
Thank you for responding. I have done my best to follow Josh's setup, but I still get the dreaded "Internet Explorer cannot display the webpage" error. I did set up wireshark on my Tomcat server and there is communication between Tomcat and the F5. The capture did not show anything wrong. What I need is advice on how to debug my problem. I attempted to open a support case, but those seem to take quite a while to get resolved. I sent support the wireshark captures and an F5 dump. If I can't get this going soon, I will have to log it as a bug and move on to other work I have pending.
- MarkM_63051Nimbostratus
Josh,
Thank you for the troubleshooting suggestions. Here are the openssl check results:
D:\workspace\F5>openssl s_client -connect 16.124.133.211:443 Loading 'screen' into random state - done CONNECTED(0000011C) depth=0 /C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAd dress=root@localhost.localdomain verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAd dress=root@localhost.localdomain verify return:1 --- Certificate chain 0 s:/C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAddre ss=root@localhost.localdomain i:/C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAddre ss=root@localhost.localdomain --- Server certificate -----BEGIN CERTIFICATE----- MIIDrDCCApSgAwIBAgICAukwDQYJKoZIhvcNAQEFBQAwgZgxCzAJBgNVBAYTAlVT MQswCQYDVQQIEwJXQTEQMA4GA1UEBxMHU2VhdHRsZTESMBAGA1UEChMJTXlDb21w YW55MQswCQYDVQQLEwJJVDEeMBwGA1UEAxMVbG9jYWxob3N0LmxvY2FsZG9tYWlu MSkwJwYJKoZIhvcNAQkBFhpyb290QGxvY2FsaG9zdC5sb2NhbGRvbWFpbjAeFw0x MjAxMTYyMzM3MzRaFw0yMjAxMTMyMzM3MzRaMIGYMQswCQYDVQQGEwJVUzELMAkG A1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxEjAQBgNVBAoTCU15Q29tcGFueTEL MAkGA1UECxMCSVQxHjAcBgNVBAMTFWxvY2FsaG9zdC5sb2NhbGRvbWFpbjEpMCcG CSqGSIb3DQEJARYacm9vdEBsb2NhbGhvc3QubG9jYWxkb21haW4wggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDcEil+9x9bTq9nz3SskYtAixSQ03hVjrNY 8f0/tf1IudJesxqJdRSbfe3xKW5FcTsGEQhUq+6lNj5CCKU95Iemw4pjud4YPPlO fZcvbYVdiGg2D4rDiXz5GyPADZQNwAOygox7qHzoq6IELWGOwPcqo14fiL12Owq4 oMtHr4xRpYuGtF7bJunxEG9MqwISuP0XKfDGyHJzLI9XdaHUUG/aQEYu9/I/1w8Y tCya9g8HX0pJp/GdCiUlprTeP9T37+e875RYF/Xs4EXF+BgSKqeXhj0O1WXQf6iY P0VTiYSDv8Qf5YBOYfVJN1CG3M4tprvftJwZGwJ/pBIUU84bdK0TAgMBAAEwDQYJ KoZIhvcNAQEFBQADggEBAE49a8CVK+/lMqqc8d4rBAxbsK7F/D55E8BCqjOqG6DY qNyHOHWYUNnu7FNEwdH8PI0+mvex8d/lsTaRbS2L65Cq0w7pmO38F6GH059W9ggB D8ZUCSeg3QLOwLQxQ2xKZWXQg2/peS0eATX/X1kk9DgURltu59kfzqHWRLiyDf01 gpAfZkiBfth5XQ+YCDg5DhkRJag1cU+nZJO3p9m+RoXq+3ZFjUov0RYkfuHZ3FLW 9fmc4PHQvCMRWgpxb5Obx3RHvRmaggNt/iAhgV+LiXzyElDUYicxqBjERljlIzHJ JavGZBelQ2cGke2LZ53X1PX5uDhlRhWZS/EZa/R9eqY= -----END CERTIFICATE----- subject=/C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAd dress=root@localhost.localdomain issuer=/C=US/ST=WA/L=Seattle/O=MyCompany/OU=IT/CN=localhost.localdomain/emailAdd ress=root@localhost.localdomain --- No client certificate CA names sent --- SSL handshake has read 1094 bytes and written 438 bytes --- New, TLSv1/SSLv3, Cipher is RC4-SHA Server public key is 2048 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : RC4-SHA Session-ID: D9A0D60F9E9CB02B365E80D1FD202CF5B624EE69A6C966F0BD1D64584A5EF0D0 Session-ID-ctx: Master-Key: B1355D7EE08AC2875F4B70B06C932CA7855157A8D6C148BE1D1E90209C9A6DC9 0CBDE196A3C4E99F318AF92A112B77E0 Key-Arg : None Start Time: 1327424988 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- read:errno=0 D:\workspace\F5>
- nitassEmployeefrom the openssl s_client output, i think clientssl profile is okay.
- MarkM_63051NimbostratusWhat are the tmsh equivalent commands?. I am using LTM version 11.1 with Hotfix HF1.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com