Forum Discussion
SSL decryption/re-encryption w/iRule feeding into HTTPS load balance
- Nov 01, 2017
I was able to get the service working after discovering the issue using tcpdump to capture the full flow of traffic.
What I found was the client side SSL profile was working correctly, the LTM was intercepting the traffic and was decrypting the flow, and was using TLS 1.2. However when the LTM’s server side profile negotiated SSL with the server it was somehow settling on TLV 1.0, which the server rejected. I changed the cipher list in the SSL server profile to only use TLS 1.2 and everything worked.
I don't follow a couple of things with this setup.
-
Why do you have a cert on the server ssl profile? Does the internal SSL require a client cert? or are you verifying the internal server certs (i.e. using the self-signing cert as the CA on the server ssl profile)
-
What makes you think you're sending traffic cleartext from the external BigIP to the internal?
-
You say you see the external BigIP presenting the cert from the client ssl profile. But does the negotiation complete? And does the request actually get sent?
From your description... I think what's happening is the client ssl profile negotiation isn't completing. You make no mention of the request actually coming through to the external BigIP, Which is required BEFORE the external BigIP will open a connection to the internal BigIP...
What are you testing with? curl? openssl and typing the request by hand? a browser? I'd recommend openssl myself... Or curl if you aren't comfortable with that. It'll give you a much better sense of what's happening on the external-client side of the connections.
H
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com