# pool member sending Alert (Level: Fatal, Description: Unknown Certificate \[46\]) for a new SSL Cert of a VS **URL:** \ **Category:** Technical Forums\ **Created:** [July 23, 2020, 6:19am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869 "2020-07-23T06:19:58Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 6:19am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/1 "2020-07-23T06:19:58Z")
Current wildcard cert (2048 bit key size) about to expired used for SSL offloading on HTTPS VS. New cert (4096 bit key size) was applied to the that VS and application breaks. VS server also has SSL Server profile (factory default). The tcpdump shows F5 Self IP sends client hello. Pool member (Tomcat) sends certificate installed on backend to F5 Self IP. Next there is client key exchange from F5 Self IP. Followed by encrypted handshake message and application data exchange between them. Next pool member sends client hello to VS. VS sends server hello and the new cert to pool member. But, pool member sends  Alert (Level: Fatal, Description: Unknown Certificate [46]) to VS. And communication ends with TCP FIN. Can’t wrap my head around. Any suggestion? ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 23, 2020, 7:59am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/2 "2020-07-23T07:59:24Z")
Hi masajjad, if you use SSL 2 ways between the Virtual Server and the Tomcat server. It’s necessary that the Tomcat server can check if the certificate is signed by an authorized CA. Have you checked if the Tomcat has the CA who signed the certificate in his trust store? Regards ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 9:22am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/3 "2020-07-23T09:22:28Z")
Appreciate your reply Lidev. Earlier same client side cert was installed on Tomcat server. Now that wildcard is expiring Security does not want us to install new client cert on back end. We installed a new cert on back-end that was signed by our “local CA”. F5 knows that local CA. From tcpdump we see can see that new cert being used to secured communication between F5 (self IP) and pool member (only one server in the back-end). Afterwards we also see VS (not self IP) is also sending the new cert as part of SSL handshake that is where application breaks. Hope it shades some light. Thanks. ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 9:38am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/4 "2020-07-23T09:38:14Z")
I came across this [[openssl-users] What does this error mean? sslv3 alert certificate unknown:state 23](https://mta.openssl.org/pipermail/openssl-users/2017-April/005683.html) _\> Secure Sockets Layer_ _\> TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Certificate Unknown)_ _\> Content Type: Alert (21)_ _\> Version: TLS 1.2 (0x0303)_ _\> Length: 2_ _\> Alert Message_ _\> Level: Fatal (2)_ _\> Description: Certificate Unknown (46)_ _Client objects to the server chain. Either does not trust the MiTM root CA, or_ _is unhappy about its encoding (assuming tshark is not generating an FP warning)._ And here is the tcpdump analysis that highlights our situation. 1. Bank-end sends Locally signed Cert to F5 Self IP. F5 likes it and we see Client Key Exchange. 2. VS sends new 4096 bit key size client cert (signed by Entrust that signs current one as well) to back-end 3. Back-end flags Alert Cert Unknown. ![image_211193.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/c/c618a47850efea7db8e31cf72a676fddd4c1e8b3.png) ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 23, 2020, 10:26am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/5 "2020-07-23T10:26:41Z")
Thank you for this clarification and the tcpdump. Can you post you SSL profile configuration to help debugging ? Also, disable **Generic Alert** in SSL profile, when the setting is disabled, the system sends more specific SSL alert messages. ![image_211194.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/5/5e3047e07df77ce1afadd60040d34f843ffd4ebe.png) ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 10:51am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/6 "2020-07-23T10:51:55Z")
Thanks for you time and effort to help me out. Current wildcard is expiring this Sunday. So, it’s a bit of crisis. Disabling Generic Alert in client SSL profile did not add much detail. Both cases I see only handshake error message between pool member and VS. Nothing much besides this error. I had tail -f /var/log/ltm running Jul 23 06:32:49 Ottciof5101 warning tmm1[21959]: 01260013:4: SSL Handshake failed for TCP 10.5.15.120:62226 → 10.5.29.11:443 Jul 23 06:38:11 Ottciof5101 warning tmm1[21959]: 01260013:4: SSL Handshake failed for TCP 10.5.15.120:62242 → 10.5.29.11:443 This being a wildcard cert it was used on multiple client SSL profile. I created a custom parent SSL profile pointed the new cert there. And all old SSL profiles were extended from that custom parent instead of factory default **(/Common)(tmos)** ltm profile client-ssl clientssl\_Wildcard\_COMPANY { app-service none cert-key-chain { Wildcard\_COMPANY\_2020\_Entrust\_Chain\_Bundle\_Dec\_2030\_0 { cert Wildcard\_COMPANY\_2020.com chain Entrust\_Chain\_Bundle\_Dec\_2030 key Wildcard\_COMPANY\_2020.com } } defaults-from clientssl inherit-ca-certkeychain true inherit-certkeychain false } **(cfg-sync In Sync)(Active)(/HR)(tmos)#** ltm profile client-ssl HR-Accero-SNI\_cfmws.com-SHA2 { app-service none cert-key-chain { Wildcard\_COMPANY\_2020\_Entrust\_Chain\_Bundle\_Dec\_2030\_0 { cert /Common/Wildcard\_COMPANY\_2020.com chain /Common/Entrust\_Chain\_Bundle\_Dec\_2030 key /Common/Wildcard\_COMPANY\_2020.com } } defaults-from /Common/clientssl\_Wildcard\_COMPANY generic-alert disabled inherit-ca-certkeychain true inherit-certkeychain true server-name \*.ab[c.com](http://c.com) sni-default true } ltm profile client-ssl HR-Accero-SNI\_cfpsa.com\_SHA2 { app-service none cert-key-chain { Wildcard\_COMPANY\_2020\_Entrust\_Chain\_Bundle\_Dec\_2030\_0 { cert /Common/Wildcard\_COMPANY\_2020.com chain /Common/Entrust\_Chain\_Bundle\_Dec\_2030 key /Common/Wildcard\_COMPANY\_2020.com } } defaults-from /Common/clientssl\_Wildcard\_COMPANY generic-alert disabled inherit-ca-certkeychain true inherit-certkeychain true server-name \*.xyz[.com](http://XYZ.com) } ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 23, 2020, 12:23pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/7 "2020-07-23T12:23:57Z")
The configuration of Client SSL profiles looks good. Can you provide the result of theses commands please ? ```tcl openssl s_client -connect : openssl s_client -connect : ``` ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 3:14pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/8 "2020-07-23T15:14:43Z")
Excuse my delay. Pardon me… instead of replying back I was writing answer. Organized mess 🙂 @syslog:~$ openssl s\_client -connect 10.5.29.11:443 CONNECTED(00000003) depth=2 C = US, O = “Entrust, Inc.”, OU = See [www.entrust.net/legal-terms](http://www.entrust.net/legal-terms), OU = “(c) 2009 Entrust, Inc. - for authorized use only”, CN = Entrust Root Certification Authority - G2 verify return:1 depth=1 C = US, O = “Entrust, Inc.”, OU = See [www.entrust.net/legal-terms](http://www.entrust.net/legal-terms), OU = “(c) 2012 Entrust, Inc. - for authorized use only”, CN = Entrust Certification Authority - L1K verify return:1 depth=0 C = XX, ST = XX, L = XX, O = X Y Z, XX = \*.[abc.com](http://abc.com) verify return:1 --- Certificate chain 0 s:/C=xxxxx/CN=\*.[abc.com](http://abc.com) i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K 1 s:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 2 s:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 i:/C=US/O=Entrust, Inc./OU=See [www.entrust.net/legal-terms/OU=(c)](http://www.entrust.net/legal-terms/OU=(c)) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 --- Server certificate Server public key is 4096 bit Verify return code: 0 (ok) syslog:~$ openssl s\_client -connect 10.5.15.120:443 CONNECTED(00000003) depth=0 C = XX, ST = XX, L = XX, O = xxxxxxx, OU = IT, CN = \*.abc.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 C = XX, ST = XX, L =XX, O = xxxxxxxx, OU = IT, CN = \*.abc.com verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/C=xx/ST=xx/L=xx/O=xxxxxxxx/OU=IT/CN=\*.abc.com i:/DC=com/DC=domain/CN=COLOCAL-CA --- Server certificate -----BEGIN CERTIFICATE----- subject=/C=XXXXXXXX/OU=IT/CN=\*.[abc.com](http://abc.com) issuer=/DC=com/DC=domain/CN=COLOCAL-CA --- No client certificate CA names sent Server public key is 4096 bit Verify return code: 21 (unable to verify the first certificate) --- closed I am taking the client doing SSL connection request does not have the Local CA cert installed. ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 23, 2020, 3:36pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/9 "2020-07-23T15:36:14Z")
if the test were performed from the BIG-IP, you find the root cause of your issue 😉 Double check the CA assign on your SSL Client and Server profile (you may have forgotten to include intermediate chain) . if you perform TLS 2 ways, check also Trusted Certificate Authorities. ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 23, 2020, 4:29pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/10 "2020-07-23T16:29:41Z")
Hi Lidev, Appreciate your continued feedback. 1. Cert of “Local CA” that signed the cert for back-end was imported to F5 (from **System**  \>  **File Management**  \> **SSL Certificate List)**. 2. From tcpdump we see back-end send that newly generated cert signed by the Local CA and F5 does client exchange. This suggests F5 knows about the Local CA that signed the cert for back-end 3. Issue arises when F5 sends (Public CA signed) cert to back-end. We send public CA chain bundle for both and new cert from SSL profile. Am I missing something from your reply? Thanks again. ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 24, 2020, 6:50am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/11 "2020-07-24T06:50:39Z")
Hello, It looks like an SSL configuration problem on the backend server side, enable SSL log debug on your F5 BIG-IP . ```tcl modify /sys db log.ssl.level value Debug ``` _don’t forget to disable SSL debug logging after by typing the following command: (modify /sys db log.ssl.level value Warning)_ Also start a SSL Dump to monitor all SSL trafifc ([https://support.f5.com/csp/article/K10209](https://support.f5.com/csp/article/K10209)) With all this, you will have more information about SSL traffic and you may have more insight into the problem you are facing. ---
**Author:** ![masajjad](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@masajjad](https://community.f5.com/u/masajjad)\ **Post date:** [July 24, 2020, 4:00pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/12 "2020-07-24T16:00:57Z")
Hi Lidev, Turns out there is some authentication component of the application that requires the frontend cert. We copied the external cert to backend and issue was fixed. We were chasing out own tail. Thanks a lot for your time and effort. ---
**Author:** ![Lidev](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lidev/32/3447_2.png) [@Lidev](https://community.f5.com/u/Lidev)\ **Post date:** [July 27, 2020, 7:45am UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/13 "2020-07-27T07:45:31Z")
Hi masajjad, I’m glad to hear it. please don’t forget to mark the answer as “the best” in order to pass your post as resolved. Regards ---
**Author:** ![cpalacio](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@cpalacio](https://community.f5.com/u/cpalacio)\ **Post date:** [August 21, 2024, 4:21pm UTC](https://community.f5.com/t/pool-member-sending-alert-level-fatal-description-unknown-certificate-46-for-a-new-ssl-cert-of-a-vs/45869/14 "2024-08-21T16:21:20Z")
Hi masajjad, I’m facing the same issue, in this case I understand you uploaded the same certificate for client and server side ssl profile, right?