Forum Discussion

mishpan_70054's avatar
mishpan_70054
Icon for Nimbostratus rankNimbostratus
Aug 16, 2012

Regarding SSL-offload on 6900 box (FIPS-HSM enable)

I have four 6900 boxes (FIPS-HSM enable) which are handling traffic coming from above ha pair (3900 boxs). Now if these four 6900boxes have to off-load traffic for https://abc.com, do have to generated CSR request for each box (which means four private key) for CN-abc.com? or i can generate one CSR and use the same key & certificate ?

 

 

 

 

cheer

 

mishpan

 

config
design
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Aug 27, 2012
    Hi mishpan,

     

     

    I think you should be able to join each of the 6900s into the same FIPS domain and then generate a single CSR on one unit. You could check the manual, test and/or open a case with F5 Support to confirm.

     

     

    Manual Chapter: BIG-IP Platform FIPS 140 Options

     

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-platform-fips-administration/1.html

     

     

    Aaron
  • mishpan_70054's avatar
    mishpan_70054
    Icon for Nimbostratus rankNimbostratus
    Sep 26, 2012
    Thanks for reply,

     

     

    but the problem here is that, as per design i con not put these 6900 under same domain. And they have to work separately.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Sep 26, 2012
    If you can't add the FIPS devices to the same domain then I think you'll need to generate separate CSRs on each. You could confirm this with F5 Support.

     

     

    Aaron
  • Eduardo_N__1674's avatar
    Eduardo_N__1674
    Icon for Nimbostratus rankNimbostratus
    Sep 28, 2014

    Is the FIPS external HSM's (ie a networked one like Thales) or the integrated FIPS module (these models usually end in F)?