Forum Discussion
Multiple two-way SSL client Profiles - possible?
Hello
To simply describe my situation:
- multiple end-users with client SSL certs generated by different CAs (down to rootCAs, which are different)
- one VIP to server them all and perform two-way SSL with "peer-cert-mode required" in the client-ssl profile.
- the FQDN for the VIP is the same for all end-users, so the server-side certificate is the same for all of them
- platform used: redundant BigIP LTM i4800 running v17
My initial reaction was to "bundle" all the different CAs into one file and use it as such under the client-ssl profile (it works)
But... I was thinking if I could create and attach to the VIP multiple client-ssl profiles for each of the CAs (each with its own defined ca-file), using the same server-side certificate (with at least one of these profiles to have the sni-default set to true), and also keeping the "peer-cert mode required" for each of these distinct client-ssl profiles. Would this even be possible, what would this break or what gotchas I should be aware of,?
ltm profile client-ssl mTLS-profile1 {
ca-file firstCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default true
}
ltm profile client-ssl mTLS-profile2 {
ca-file secondCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default false
}
ltm profile client-ssl mTLS-profile3 {
ca-file thirdCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default false
}
ltm virtual server-fqdn-vip {
...
profiles {
mTLS-profile1 {
context clientside
}
mTLS-profile2 {
context clientside
}
mTLS-profile3 {
context clientside
}
}
...
}
Thank you in advance
Adrian
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com