Forum Discussion

Dazzla_20011's avatar
Dazzla_20011
Icon for Nimbostratus rankNimbostratus
Mar 25, 2011

Server-side SSL

Hi,     Currently we only do client-side SSL on the F5. I've been asked if we can encrypt the traffic from the F5 to web servers. I know the F5 can do server side ssl so just wonderered if some...
config
design
Arie's avatar
Arie
Icon for Altostratus rankAltostratus
Jan 20, 2014

Some suggestions:

 

  1. Depending on the security requirements, you may be able to save some cycles by using weaker encryption in the DMZ.
  2. Use the longest expiration the security requirements allow. In my experience many organizations purchase certs with a one-year expiration because of financial/budget consideration and/or uncertainty regarding the life span of the web site. Setting the self-signed cert to expire later saves some administrative overhead.
  3. Use the same self-signed cert in the DMZ for all VIPs if the security requirements allow it.