Forum Discussion

som_86408's avatar
som_86408
Icon for Nimbostratus rankNimbostratus
Jun 04, 2018
Solved

Self Signed cert on Server and external CA cert on F5

Hi,

 

In a recent requirement, I have to use SSL encryption in between client to F5 and F5 to back end servers communication. I am familiar with the first one which will be served by external CA and at the F5 end client side SSL profile will be used.

 

But my query is on the second one i.e. F5 to back end servers. As per the requirement self-signed certificate will be used at the back end servers.

 

Please clarify the below queries?

 

  1. As self-signed certificate will be used so do we need to import the server certificate and key under server SSL profile in F5?
  2. If yes, is there any other way around this can be done without importing the certificate in F5.

Thanks/Som

 

application delivery
BIG-IP
LTM
server ssl profile
  • Martijn_144688's avatar
    Martijn_144688
    Jun 04, 2018

    Hi,

     

    When the backend server is using self signed certificates, you can use the serverssl-insecure-compatible SSL profile on the server side.

     

    This way, the F5 accepts the self signed certificate without the need to import anything on the F5.

     

    Regards, Martijn.

     

8 Replies

Sort By
  • Martijn_144688's avatar
    Martijn_144688
    Icon for Cirrostratus rankCirrostratus
    Jun 04, 2018

    Hi,

     

    When the backend server is using self signed certificates, you can use the serverssl-insecure-compatible SSL profile on the server side.

     

    This way, the F5 accepts the self signed certificate without the need to import anything on the F5.

     

    Regards, Martijn.

     

    • som_86408's avatar
      som_86408
      Icon for Nimbostratus rankNimbostratus
      Jun 04, 2018

      Thanks but as far as I know the server-insecure-compaitable ssl profile is used if weak cypher is used at the server end certificate.

       

      Are you sure that this can be used at the f5 end in case of self signed certificate also? Please confirm.

       

      Thanks.

       

    • Martijn_144688's avatar
      Martijn_144688
      Icon for Cirrostratus rankCirrostratus
      Jun 06, 2018

      Hi,

       

      The best way is to use a valid certificate on the server that suits your security requirements and make sure the F5 accepts (trust) this certificate.

       

      If you use a self signed certificate and you have minimum control on the ciphers being used, the server-insecure-compatible is the best option.

       

      You can create your own server SSL profile (maybe based on the server-insecure-compatible profile) and change the ciphers in Advanced settings.

       

      Martijn

       

  • Martijn_van_de1's avatar
    Martijn_van_de1
    Icon for Cirrus rankCirrus
    Jun 04, 2018

    Hi,

     

    When the backend server is using self signed certificates, you can use the serverssl-insecure-compatible SSL profile on the server side.

     

    This way, the F5 accepts the self signed certificate without the need to import anything on the F5.

     

    Regards, Martijn.

     

    • som_86408's avatar
      som_86408
      Icon for Nimbostratus rankNimbostratus
      Jun 04, 2018

      Thanks but as far as I know the server-insecure-compaitable ssl profile is used if weak cypher is used at the server end certificate.

       

      Are you sure that this can be used at the f5 end in case of self signed certificate also? Please confirm.

       

      Thanks.

       

    • Martijn_van_de1's avatar
      Martijn_van_de1
      Icon for Cirrus rankCirrus
      Jun 06, 2018

      Hi,

       

      The best way is to use a valid certificate on the server that suits your security requirements and make sure the F5 accepts (trust) this certificate.

       

      If you use a self signed certificate and you have minimum control on the ciphers being used, the server-insecure-compatible is the best option.

       

      You can create your own server SSL profile (maybe based on the server-insecure-compatible profile) and change the ciphers in Advanced settings.

       

      Martijn