Forum Discussion

Fabou_139732's avatar
Fabou_139732
Icon for Nimbostratus rankNimbostratus
Feb 24, 2016

SSL Certificate Testing while servers not configured

I have setup an HTTPS VIP and I can see that all the servers are green (connectivity is OK) hence the VIP is showing green as well. The issue is that Apache has not been confgured yet so in theory th...
application delivery
BIG-IP
certificate
LTM
ssl
  • BinaryCanary_19's avatar
    BinaryCanary_19
    Feb 24, 2016

    Yes, it is normal, because the BigIP is a full proxy.

     

    Your client will establish a connection to the bigIP independently, and then the bigip will establish a connection to the backend server. The two are independent, and the client connection will have to complete before bigip establishes a server connection.

     

    Since you have an SSL profile on the VIP, then the client is going the whole length to complete the SSL handshake, and then send the GET request. So you get the ssl certificate warning because you need to trust the certificate in order for the handshake to complete.

     

BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account

Yes, it is normal, because the BigIP is a full proxy.

 

Your client will establish a connection to the bigIP independently, and then the bigip will establish a connection to the backend server. The two are independent, and the client connection will have to complete before bigip establishes a server connection.

 

Since you have an SSL profile on the VIP, then the client is going the whole length to complete the SSL handshake, and then send the GET request. So you get the ssl certificate warning because you need to trust the certificate in order for the handshake to complete.

 

BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account
Feb 24, 2016
YOu can check the issuer of the certificate you are seeing in the browser; it it matches what you got from Entrust, then it likely means that your browser does not have a complete chain of trust leading up to a root CA which the browser itself trusts. For such cases, you are supposed to also configure an intermediate certificate chain on the ssl profile; you might have received an "intermediate" certificate from Entrust, or they may have provided you with instructions on how to download one, or you can contact them and ask them to give you one. Then you simply add it to your bigip as the Chain certificate and this should help allow more browsers to validate it.