Forum Discussion
NimbostratusSSL Mutual (Two-way) Authentication Load Balancing
We're being asked to provide SSL Mutual (Two-way) Authentication Load Balancing via LTM for an application served by Tomcat, but our developers aren't able to provide very much information regarding the application and I'm wondering if anyone has any gotchas or best practices that might assist in the process.
It seems to me that simply setting up both client and server SSL profiles on the VS in order to keep all the neato LTM magic sauce, and using an appropriate method of session persistence will get the job done. Is there anything in those assumptions that is incorrect?
I've done some digging and I'm not sure what to make of information like this or this in terms of its applicability to this scenario. With SSL Mutual Auth, might I need to use passthrough instead of decrypting at the LTM and re-encrypting from the LTM to our application servers?
2 Replies
- Kevin_Stewart
Employee
I guess it depends on your definition of mutual auth. For SSL it usually means using client AND server certificates on the client side of the proxy. Are you, however, referring to decryption and then re-encryption across the proxy?
- Kevin_Stewart
Per the referenced article:
Mutual SSL provides the same things as SSL, with the addition of authentication and non-repudiation of the client authentication, using digital signatures
This in effect relates to client certificates. In any SSL negotiation the server's certificate is always presented, so mutual authentication would also require the client's certificate. Now in terms of the proxy layer, if you offload (and optionally re-encrypt) at the VIP, then you have two separate client-server SSL sessions: client side (client to F5 server) and server side: (F5 client to web server). If you don't decrypt, then you have a single tunneled SSL session between the client and web server.
So if you need to do mutual SSL on the client side of the proxy, that's pretty straight forward. If you need to do mutual SSL on the server side of the proxy, that too is possible (between the F5 client and web server). But if you need the client's certificate at the web server, your options are limited to tunneling and ProxySSL.
