Forum Discussion
iamsajjad
Cirrus
CirrusProblem applying 2 EC certs to a VS - NET::ERR_CERT_COMMON_NAME_INVALID
We have a virtual server that is currently configured for SSL Offloading using an L1F EC cert by Entrust. Current cert has about 240 SANs. Customer wants to add few more SANs. To manage it efficientl...
About common name field, it was suggestion. According to link below in 14.1.4 version it isn't necessary. F5 matches SNI with SAN list.
Unfortunately, I don't have any more ideas how to solve it. Looks like a bug and reason to open a support case.
https://support.f5.com/csp/article/K13452
"For Server Name, enter the name of the HTTPS site.
Note: Beginning in BIG-IP 11.6.0, if you leave Server Name blank, the BIG-IP system reads the Subject Alternative Name (SAN) from the certificate. For versions prior to BIG-IP 11.6.0, if you leave Server Name blank, the BIG-IP system reads the Common Name (CN) from the certificate. Additionally, the Server Name setting supports wildcard strings containing the asterisk (*) character. For example, *.domain.com matches a.domain.com or a.bc.domain.com, but it does not match domain.com)."
MaximPCirrus
CirrusSeems that configuration is fine.
I'd try to capture traffic to make sure that client provide proper hostname in SNI and server responses with proper certificate.
iamsajjadCirrus
CirrusI see the server name in SNI extension of Client Hello. But, the F5 server hello presenting the first (default) cert.