SNI Sites not taking correct certificate.

Question

I have configured one VIP with two certificate

aks.test.com

aks4.test.com

On SSL profile for aks.test.com i have enabled SNI feature and aks.test.com is working fine taking correct certificate (aks.test.com).

but aks4.test.com having not secure error on browser and taking the certificate of (aks.test.com).

Could someone please help what could be the issue in this case.

f5_design_engineer · Answer

Hi Militza,
&nbsp;
You can use the openssl command-line tool to check if SNI is configured correctly.
Here's a command you can run:
openssl s_client -servername aks4.test.com -connect aks4.test.com:443 -tlsextdebug
This command will show you the details of the SSL/TLS handshake, including whether the server is using the correct certificate for the specified hostname
Check and share the test results.

blue_whale · Answer

I hope you have done this ..If so , it should have worked ..aks.test.com &nbsp;&gt;&gt; On this ssl profile tick the check box - "Default SSL Profile for SNI"aks4.test.com

militza · Answer

Yes it is done. but not working

paulius · Answer

Would you be able to provide your SSL profiles configuration associated to this virtual server and the virtual server configuration so we can look at this further?

militza · Answer

ltm profile client-ssl clientssl-aks.test.com {&nbsp; &nbsp; app-service none&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; aks.test.com_CA_Cert {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert aks.test.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; chain CA_aks.test.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key aks.test.com&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; defaults-from clientssl_cipheradapted&nbsp; &nbsp; inherit-ca-certkeychain true&nbsp; &nbsp; inherit-certkeychain false&nbsp; &nbsp; options { dont-insert-empty-fragments no-dtlsv1.2 }&nbsp; &nbsp; server-name none&nbsp; &nbsp; sni-default true}&nbsp;ltm profile client-ssl clientssl-aks4.test.com {&nbsp; &nbsp; app-service none&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; aks4.test.com_CA_Cert {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert aks4.test.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; chain CA_aks4.test.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key aks4.test.com&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; defaults-from clientssl_cipheradapted&nbsp; &nbsp; inherit-ca-certkeychain true&nbsp; &nbsp; inherit-certkeychain false}

Forum Discussion

SNI Sites not taking correct certificate.

8 Replies

AppWorld Berlin 2026 – iRules Contest Winning Results

One Quick Step to Make your website AI-Agent/MCP Ready with an iRule

IPv8 Would Fix My Routing Tables. It Will Never Ship.

Recent Discussions

syslog over tcp and define management IP as source

VIP control across data centers - how to ensure only 1 VIP is up at a time?

migrate from serie I to R. Cluster LTM-GTM

Errors with AS3 3.56.0 with F5 17.5.1.6

CPU/vCPU sizing on rseries

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS