Forum Discussion
Mutual SSL Certificate Authentication
http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_1/ltm_ssl_profiles.html1298333
I then preceeded to setup the authentication profile with SSL Client Certificate LDAP authentication.
http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_1/ltm_auth_profiles.html1186130
However, for some reason, everytime I tried to access the virtual server site and send the certificate, the authentication kept failing. Note that I am using a self signed certificate and imported the certificate into the F5 box as well and set the CA as the certificate itself.
Please help as I cannot find many resources or articles on this posted on Ask F5. Thanks.
- hooleylistCirrostratusHi,
- Stevenson_88156NimbostratusI had also tested removing the auth portion of our virtual server and it didn't work.
- nemmankNimbostratus
Hi Stevenson, You probably have resolved your issue by now or given up on it. Mutual authentication could be using just the Client SSL to validate the browser connection traffic for the session (once or always) or you cann do a further authentication using a remote server. This remote authentication is facilitated using PAM modules on the F5 BigIP. These could be tacas, radius or even an ldap server. In your setup above, you are doing client ssl authentication using remote ldap server. The test to fish out the problem would be:
1) do you have ldap bind to your ldap server and can you do ldapsearch from bigIP CLI to the ldap server ? 2) The client certificate loaded onto the client browser, can you extract the sAMAccountName from it and matches what was held on the ldap server and in the correct object group?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com