Forum Discussion

Adrian_Turcu's avatar
Adrian_Turcu
Icon for Nimbostratus rankNimbostratus
Jun 12, 2026

Multiple two-way SSL client Profiles - possible?

Hello
To simply describe my situation:

  • multiple end-users with client SSL certs generated by different CAs (down to rootCAs, which are different)
  • one VIP to server them all and perform two-way SSL with "peer-cert-mode required" in the client-ssl profile.
  • the FQDN for the VIP is the same for all end-users, so the server-side certificate is the same for all of them
  • platform used: redundant BigIP LTM i4800 running v17

My initial reaction was to "bundle" all the different CAs into one file and use it as such under the client-ssl profile (it works)


But... I was thinking if I could create and attach to the VIP multiple client-ssl profiles for each of the CAs (each with its own defined ca-file), using the same server-side certificate (with at least one of these profiles to have the sni-default set to true), and also keeping the "peer-cert mode required" for each of these distinct client-ssl profiles. Would this even be possible, what would this break or what gotchas I should be aware of,? 

 

ltm profile client-ssl mTLS-profile1 {
    ca-file firstCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default true
}

ltm profile client-ssl mTLS-profile2 {
    ca-file secondCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default false
}

ltm profile client-ssl mTLS-profile3 {
    ca-file thirdCA.crt
    cert serverSide.crt
    chain serverSide-chain.crt
    key serverSide.key
    peer-cert-mode require
    retain-certificate false
    sni-default false
}

ltm virtual server-fqdn-vip {
...
    profiles {
        mTLS-profile1 {
            context clientside
        }
        mTLS-profile2 {
            context clientside
        }
        mTLS-profile3 {
            context clientside
        }
    }
...
}

 

Thank you in advance

Adrian

 

1 Reply

  • Hi Adrian_Turcu​ I'm not sure if I completely understand your question. But if all users are using the same FQDN, how will you identify each request and choose the correct client SSL profile from the list of client SSL profiles configured on the VIP? In this case, everytime same client-ssl profile will be used based on the FQDN.