Forum Discussion
NimbostratusSSL Pass Through VS for Safari Clients
We're experiencing an issue with a VS in our configuration which is performing SSL pass through. Clients attempting to connect to our site via Safari (from a Mac) are unable to successfully complete an SSL handshake with F5. Packet traces show that syn/ack happens fine. The client (Safari) then sends a client hello which is ack'd by F5. The very next packet in the trace, however, is consistently a RST, terminating the handshake.
We are planning on making some changes to our site configuration in the near future which will allow us to perform SSL termination. This handshake issue with Safari clients magically disappears in our test environment when we enable SSL termination.
Prior to moving this infrastructure behind F5, Safari clients were able to visit the site without problems.
In the mean time we are really just looking for some sort of temporary workaround to appease our Safari clients.
We currently have a ticket open with F5 support on the issue but I figured I would post here and see if anyone else has run into similar issues. Whether you have or have not I'm open to suggestions if anyone has any.
Currently running 11.1.0 HF2 on a Big-IP 3900. The machine I have available to test with is running Safari Version 5.1.7 (7534.57.2) on OSX 10.7.4. The exact same Safari version running on a PC works fine.
If you need any further info or clarification, let me know.
4 Replies
- nitass
Employee
We're experiencing an issue with a VS in our configuration which is performing SSL pass through. Clients attempting to connect to our site via Safari (from a Mac) are unable to successfully complete an SSL handshake with F5. Packet traces show that syn/ack happens fine. The client (Safari) then sends a client hello which is ack'd by F5. The very next packet in the trace, however, is consistently a RST, terminating the handshake.have you tried to change cipher suites on safari? i am not sure but i think resetting right away after client hello message may relate to cipher issue.
just my 2 cents. 
AnglerIf it's ssl pass through then the ssl handshake is performed with the pool member not the big-IP. The big-IP is simply passing the connection to the server. The issue probably lies there.- Brian_Van_StoneDetermined late yesterday that it is a server issue, not an F5 issue. Doesn't appear to be a cipher suite issue but it did send me down a path that appears to get us closer.
Thanks for the quick response. - Brian_Van_StoneDefinitely not an F5 issue but I figured I would post this here in case anyone else runs into this problem in the future and comes looking here.
Safari (even the latest version) does not support RFC 5746, which addresses an issue concerning SSL renegotiation which would allow a man in the middle attack. The description of the vulnerability can be found here: http://www.phonefactor.com/sslgap
The vulnerability was identified in August of 2009 and the actual standard to fix it proposed in Feb 2010. All other major browsers (IE, FF, Opera, Chrome, etc.) appear to have been compliant for quite a while.
Recent security patches to our web servers have enforced a requirement for RFC 5746 compliance. F5 Big-IP appears to be compliant, since it can communicate via SSL to these same web servers, but also tolerant of non-compliant clients. It is for this reason that SSL termination makes our problem disappear.
Sorry to spawn a thread unrelated to F5 config, but perhaps this will be useful to someone in the future.
