For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

2 Replies

  • IanB's avatar
    IanB
    Icon for Employee rankEmployee
    Feb 20, 2016

    What you're trying to do is exactly what the chain of trust that SSL uses to verify a website was designed to prevent.

     

    I'm simplifying slightly, but when a certificate is issued for a website, it is signed by a trusted authority. That authority is deemed to be trusted because their root certificates are implicitly trusted by the browser. Geotrust, Digitrust, etc all have certificates that are pre-installed on every current operating system. In other words, when the website's certificate says it is valid for *.f5.com, that statement is signed by a chain of certifcates that end in one that the browser implicitly trusts.

     

    Having said that, if you control the clients and have installed your certificate on them and told them to trust it as root CA, then you can set up a scenario where the BigIP is able to substitute the real website's certificate with one that it generated and signed on the fly, and the client will trust it because it trusts the signer.

     

    We have a document which explains in more detail how it works, and how to configure it If you're interested, please take a look at our SSL intercept deployment guide

     

    Note that if you were to deploy this without the trusted root certificate on the client, then any browser being directed through the service would alert the user that every https:// site's certificate could not be validated.

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 20, 2016

    Hi Cathy,

     

    after Ian's answer, I'm somewhat unsure if you need the stealth redirect in a forward proxy (aka. a Browser accesses the internet) or a reverse proxy scenario (aka. the internet access your web servers.

     

    I you need the stealth redirect in a forward proxy scenario then Ian's answer would be the solution.

     

    But if you need the silent redirect in a reverse proxy scenario, then you have to configure SSL-Termination of your Virtual:443, by assigning a Client- and Server-SSL-Profile. In this case the F5 can terminate and inspect the HTTPS request and then perform any kind of content manipulation.

     

    https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_0_0/ltm_ssl_profiles.html

     

    Cheers, Kai