Forum Discussion
Adrian_Turcu
Nimbostratus
Jun 12, 2026Multiple two-way SSL client Profiles - possible?
Hello To simply describe my situation: multiple end-users with client SSL certs generated by different CAs (down to rootCAs, which are different) one VIP to server them all and perform two-way SS...
Kevin_Stewart
Employee
Jul 30, 2026Ditto. You can switch the SSL profile based on the SNI in the Client Hello message...but the client cert comes to the server (BIG-IP) a few messages later and after a profile has been selected (after the Server Hello message and algorithm decision, Server Cert message, etc.). By the time you get to Client Cert it's too late to switch.
Is there a specific reason you need/want to do this, other than just keeping the CA bundles lite?
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects