Forum Discussion

Adrian_Turcu's avatar
Adrian_Turcu
Icon for Nimbostratus rankNimbostratus
Jun 12, 2026

Multiple two-way SSL client Profiles - possible?

Hello
To simply describe my situation:

  • multiple end-users with client SSL certs generated by different CAs (down to rootCAs, which are different)
  • one VIP to server them all and perform two-way SSL with "peer-cert-mode required" in the client-ssl profile.
  • the FQDN for the VIP is the same for all end-users, so the server-side certificate is the same for all of them
  • platform used: redundant BigIP LTM i4800 running v17

My initial reaction was to "bundle" all the different CAs into one file and use it as such under the client-ssl profile (it works)


But... I was thinking if I could create and attach to the VIP multiple client-ssl profiles for each of the CAs (each with its own defined ca-file), using the same server-side certificate (with at least one of these profiles to have the sni-default set to true), and also keeping the "peer-cert mode required" for each of these distinct client-ssl profiles. Would this even be possible, what would this break or what gotchas I should be aware of,? 

 

ltm profile client-ssl mTLS-profile1 {
    ca-file firstCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default true
}

ltm profile client-ssl mTLS-profile2 {
    ca-file secondCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default false
}

ltm profile client-ssl mTLS-profile3 {
    ca-file thirdCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default false
}

ltm virtual server-fqdn-vip {
...
    profiles {
        mTLS-profile1 {
            context clientside
        }
        mTLS-profile2 {
            context clientside
        }
        mTLS-profile3 {
            context clientside
        }
    }
...
}

 

Thank you in advance

Adrian

 

No RepliesBe the first to reply