For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 08, 2015

    Mutual authentication is simply an SSL handshake in which the server requests a certificate from the client. Normal (server authenticated) SSL always sends the server's certificate to the client, which only authenticates the server to the client.

     

    The easiest way to do this is a minor modification to the client SSL profile. In the Client Authentication section of the client SSL profile:

     

    1. Set Certificate Authentication to "request" or "require". The difference is that one fails open (request) if the client doesn't send a cert or sends a bad cert, and the other fails closed (require).

       

    2. Apply a CA certificate or CA bundle to the Trusted Certificate Authorities selection. This is the CA, or group of CAs that the BIG-IP will need to form a complete PKI trust chain from the client's certificate to the self-signed root CA. If the user's certificate is issued by the root CA, then you only need that root CA in this selection (you must upload that CA to the BIG-IP first). If the user's certificate is issued by a subordinate CA, then you need a CA bundle that contains all of the CA's in the trust path. The bundle is nothing more that a text file with all of the PEM-formatted CA certificates included.