Forum Discussion
NimbostratusiRules for SSL certificates
NimbostratusWe first tried to configure two-way using only Client Authentication require setting and root CA under Trusted Certificate Authorities field but it didn't work. That's why we tried with C3D.
The customer is using self signed certificate as Root CA for issuing client certificates. Could that cause the problem with first approach?
EmployeeWithout using C3D, you can get client certificate authentication from the client to the client-ssl profile, and use a shared static client authentication certificate on the server-side to the pool member.
What you cannot do is pass an individual client authentication certificate from the client-side to the server-side.
When establishing a TLS connection with a client-auth certificate, the client-auth certificate has to sign the handshake. But while the BigIP has the client auth certificate presented to it, it does not have the client auth certificate private key to sign the server-side handshake. C3D provides a way to generate a new certificate on the BigIP that matches the client auth certificate details so the server-side SSL profile can connect, present a client auth certificate that provides the right details, and can sign the handshake.
