Forum Discussion

David_Haupt_130's avatar
David_Haupt_130
Icon for Nimbostratus rankNimbostratus
Oct 05, 2013

SNI and Client certificate authentication

Hi   LTM 11.4.0 VE   I want a VS that listens to 443 and terminates TLS 1.0+ https traffic. It should have two Client SSL profiles (with different certificates and hostnames in the certificates...
application delivery
design
devops
iRules
security
sni
tls
David_Haupt_130's avatar
David_Haupt_130
Icon for Nimbostratus rankNimbostratus
Oct 12, 2013

Thanks for the excellent reply Kevin!

 

In my case I ended up with two SSL profiles and one OCSP authentication profile and an iRule that send traffic to the correct pool for the type of client as determined by the iRule looking at the certificate in CLIENTSSL_CLIENTCERT.

 

It seems to work reasonably well. I think we can live with not being able to set different cipher suites on the two SSL profiles.