Forum Discussion
NUCUSER
Cirrus
CirrusSSL Client Certification Alert 46 Unknown CA
We are seeing 'Alert 46 Unknown CA' as part of the initial TLS handshake between client & server. From a wireshark capture, the 1st Client Hello is visible, followed by the 'server hello, certificate...
Cool. If it's a web based application and browser is the client then yes it would be present. But if it's API call with server to server communication they might need to install it explicitly.
Also, other thing I would check on the F5 clientssl profile, if CA cert is correctly added to the chain (in case it's not bundled with the server cert)? Meanwhile, please verify that part as well.
Update - Thanks for all your suggestions, most helpful!! This turned out to be a client side cert password issue, client cert re-installed and now working.
jaikumar_f5
MVP
MVP,
This is a client side issue for not having the required intermediate or root certificate in the trust store of client machine. In LTM you'll just SSL Handshake failed logs, but in pcap you'll see this, alert coming from Client to LTM, SSL Fatal alert, RST.
level fatal,
value unknown_ca
Work with your client support team & have required keystore updated.
