For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ankur_5273's avatar
Ankur_5273
Icon for Nimbostratus rankNimbostratus
Jan 09, 2015

Migrate SSL Certificate from backend web server to F5

Hi Experts   We have a F5 LTM 1600 LTM V11.2.1 in Active/Standby hosting multiple websites . There are 3 websites hosted on F5 having Virtual IP 172.16.2.20 running on Service port "Any" (i.e 0) ....
Michael_Jenkins's avatar
Michael_Jenkins
Icon for Cirrostratus rankCirrostratus
Jan 09, 2015

If you're using 3 different domains and trying to get them all to 1 VIP on SSL, you can use a SAN certificate with all the domains. (If you were using a single domain and then using different subdomains (e.g. app1.myweb.com, app2.myweb.com, etc..) you could look into a wildcard certificate, but that's more expensive).

 

For migrating the certificate, you can export the cert from your web server (make sure you include the private key), and then you can import it into the F5. You'll need to make sure you import any necessary certificate chains/bundles as well onto the F5.

 

From there, you'll need to create a clientssl profile on the F5 to assign your VIP, make sure the port number on the VIP is 443 (or whatever port's on your cert), and test.

 

If you want ssl from the F5 to the back end server as well, you'll need to set up a serverssl profile on the VIP (though I think you can usually just use one of the default serverssl profiles without creating a new one).

 

Hope this helps.