Forum Discussion
Multiple two-way SSL client Profiles - possible?
Hello
To simply describe my situation:
- multiple end-users with client SSL certs generated by different CAs (down to rootCAs, which are different)
- one VIP to server them all and perform two-way SSL with "peer-cert-mode required" in the client-ssl profile.
- the FQDN for the VIP is the same for all end-users, so the server-side certificate is the same for all of them
- platform used: redundant BigIP LTM i4800 running v17
My initial reaction was to "bundle" all the different CAs into one file and use it as such under the client-ssl profile (it works)
But... I was thinking if I could create and attach to the VIP multiple client-ssl profiles for each of the CAs (each with its own defined ca-file), using the same server-side certificate (with at least one of these profiles to have the sni-default set to true), and also keeping the "peer-cert mode required" for each of these distinct client-ssl profiles. Would this even be possible, what would this break or what gotchas I should be aware of,?
ltm profile client-ssl mTLS-profile1 {
ca-file firstCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default true
}
ltm profile client-ssl mTLS-profile2 {
ca-file secondCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default false
}
ltm profile client-ssl mTLS-profile3 {
ca-file thirdCA.crt
cert serverSide.crt
chain serverSide-chain.crt
key serverSide.key
peer-cert-mode require
retain-certificate false
sni-default false
}
ltm virtual server-fqdn-vip {
...
profiles {
mTLS-profile1 {
context clientside
}
mTLS-profile2 {
context clientside
}
mTLS-profile3 {
context clientside
}
}
...
}
Thank you in advance
Adrian
1 Reply
Hi Adrian_Turcu I'm not sure if I completely understand your question. But if all users are using the same FQDN, how will you identify each request and choose the correct client SSL profile from the list of client SSL profiles configured on the VIP? In this case, everytime same client-ssl profile will be used based on the FQDN.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com