Forum Discussion
NimbostratusSSL - F5 sending TCP RST after handshake
We just renewed server's SSL certificate with 2048 bit but now F5 is sending TCP RST to the server after Handshake.
It's working when we switch back to the old certificate (1024 bit) without changing F5 config.
Here is the SSLdump:
1 1 0.0010 (0.0010) C>S Handshake
ClientHello
Version 3.1
cipher suites
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_RC4_128_SHA
Unknown value 0x2f
Unknown value 0x35
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_DES_CBC_SHA
compression methods
NULL
1 2 0.0024 (0.0013) S>C Handshake
ServerHello
Version 3.1
session_id[32]=
50 ff 8c cf 7d cc 68 fe 70 b6 d3 15 6c 6e 7c da
f6 32 a3 45 48 53 69 e1 cc a4 f7 1e 68 9a 58 8c
cipherSuite TLS_RSA_WITH_RC4_128_MD5
compressionMethod NULL
Certificate
ServerHelloDone
1 0.0027 (0.0002) C>S TCP RST
I could connect to the server using "openssl s_client -cipher 'RC4-SHA' -connect".
The server is JBOSS. We're using BIG-IP 9.2.3.
Does anyone know why?
13 Replies
What_Lies_Bene1Cirrostratus
Has the new certificate been signed by a different CA?
sgnewbie_121449Hi Steve,
Yes, we just implemented new internal CA infrastructure. Btw, I've imported the ROOT CA bundle to F5 too.
Thanks- What_Lies_Bene1
OK, and is that bundle configured in the SSLServer profile assigned to the VS, in the Trusted Certificate Authorities setting, on the F5?
- sgnewbie_121449
Yes, it's in Trusted Certificate Authorities.
Btw, one of the ROOT CA certificates is showing expiring on Jan 1, 1970 (the cert actually expires in 2048). I read an F5 SOL that I can ignore that and it's a cosmetic only (I've verified the expiry date with openssl x509 command).
Hmm . . .
- What_Lies_Bene1OK, that's good, any chance it's chained and the bundle needs to be specified in the Chain setting too?
- sgnewbie_121449
I've tried that too.
I believe the problem is between F5 and the server. I manage to apply the new cert on ClientSSL successfully.
- What_Lies_Bene1Hmmm. Any chance you could try installing and specifying the actual certificate the server presents too?
- sgnewbie_121449
I've tried that too but it's still not ok.
Thanks Steve for the response.
Hmm . . .
- sgnewbie_121449
Further checks, the new Server's SSL certificate is signed using SHA2. According to SOL6808, my BIG-IP doesn't support SHA2.
I'm trying getting for new cert signed using SHA1. See how it goes
- What_Lies_Bene1Ahh. Interesting. I'll have to read up on that, I wasn't aware. Thanks.
