For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tabber's avatar
Tabber
Icon for Altostratus rankAltostratus
Sep 18, 2019

LTM - Peer cert verify error - What is the Server IP

Running a forward proxy with SSLo and I'm trying to find a more elegant way of hunting down the server my clients are going to when I see entries like this in /var/log/ltm log   Sep 18 08:16:46 B...
LTM
security
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
Sep 18, 2019

Hi,

 

Did you see this kb:

https://support.f5.com/csp/article/K66643540

 

This message occurs when one of the following conditions are met:

  • You have a BIG-IP systems in a high availability (HA) configuration that is unable to verify a remote BIG-IP system's device trust SSL certificate.
  • You have configured a Client SSL profile to require client certificate authentication and the BIG-IP system is unable to verify the client's SSL certificate.

SSL certificate verification may fail for a variety of reasons. Two popular reasons include:

  • The received SSL certificate has not been signed by a recognized CA.
  • The received SSL certificate validity period has expired.

 

 

My question is did you perform client auth (cert)?

 

regards

Tabber's avatar
Tabber
Icon for Altostratus rankAltostratus
Sep 18, 2019

youssef,

 

I did use that kb but forgot to mention in my original post.

 

We are not performing client auth but on server SSL we are validating server SSL certificates against our Trusted CA list. The F5 is operating properly in dropping these certificates so that is no my problem. I'm trying to figure out what Server is responding with the bad certificate so I can back trace through either F5 logs or my Firewall logs to determine the clients that are reaching out to these misconfigured Servers.

 

Thank you for your advice.