Forum Discussion
NimbostratusIssue with new VeriSign certificate clients unable to access website we went from sha 128 to sha-256
Issue with new VeriSign certificate clients unable to access website we went from sha 128 to sha-256. The F5 is not rendering the site. I can access the server from one server to the other and the site is rendering with correct SSL certificate and information using local host file. I confirmed that the content of the certificate on F5 LTM is correct. Even the health monitors for HTTPS is working properly for the pool.
Very strange issue. We are running version 11.4.1 I did wire shark trace the F5 is sending the client a reset. I see nothing in thee trace indicating a certificate issue.
Any information would greatly be appreciated. If revert back to old certificate that is to set to expire April 2 2015. All works fine.
8 Replies
Alan_Renicor_10Altocumulus
What hardware are you running on? Not seen any issues with sha-256, but we had and issue with a client ssl profile change(removing insecure protocols)under 11.4 Exactly the same issue i.e web page wouldn't always render correctly when backed out everything worked . It only seemed to affect our 2000s and 4000s hardware, In the end we fixed by upgrading to 11.6 HF1. The only thing we could put it down to was a possible issue flagged under SOL15232. Just a thought.
Michael_-_Harr1LTM 4200- Alan_Renicor_10Same as us. Traces weren't obvious for us, only that certain pages didn't render almost like the CSS content had corrupted. If your running HA pair I'd suggest at least upgrading one and failing over to test if you can.
Peter_ZCirrus
another thought:
do you see the same issue in all browsers?
what about testing with CLI-based tools, e.g. curl or openssl? can you get the webpage?
- Alan_Renicor_10
One other possible issue to look for with sha-256 is the clients own environment. Validate which OS and browser they are using , our first attempt at sha256 fell foul of a client using an unpatched windows 2003 server.
External link below provides some more info https://casecurity.org/wp-content/uploads/2014/09/SHA-256-Support-List.pdf
ArieAltostratus
- Are you terminating (or bridging) SSL on the ADC?
- The monitors are generally not connecting to the origin web servers the same way a browser would.
- Does an SSL Labs report reveal anything?
- If you're terminating/bridging, did you update the CA bundle on the ADC?
- Are you using iApps? If so, is the iApp creating the SSL profiles?
- Michael_-_Harr1
1.Are you terminating (or bridging) SSL on the ADC? SSL is terminating on the server 3.Does an SSL Labs report reveal anything? Does F5 support put it in a lab environment is that what you mean? 4.If you're terminating/bridging, did you update the CA bundle on the ADC? Yes the CA bundle is on the ADC 5.Are you using iApps? No IAPPS
- Alan_Renicor_10For Point 3 , if your connection is internet facing I beleive Arie is suggesting going to https://www.ssllabs.com/ssltest/ and testing your domain to see if it flags up any issues such as incorrect ca's or possible cipher issues. You can also test your ssl cert and ca's via https://www.sslshopper.com/ssl-checker.html.
