Which Certificate Fields Does BIG-IP Alter When Using C3D?

Forums Technical Forums
, , ,
1

Hello everyone,

When the C3D feature is enabled, the BIG-IP generates a new client certificate to authenticate to the back-end server. I would like to understand which fields in the newly generated client certificate are modified (aside from the Issuer).

Specifically, is there any scenario where the BIG-IP alters the certificate’s serial number?

I’ve reviewed the documentation but couldn’t find any detailed information about which fields of the original client certificate might be affected by this feature.

Thanks in advance for your help!

Best regards,
Karim

2

Hello KarimBenyelloul​

The issuer and validity period are always changed.  **The serial number in the C3D-forged certificate is, by default, copied from the original client certificate.**However, this is not guaranteed in all cases. There are known bugs (such as Bug ID892485 referenced in KB K00185847) where the serial number may not be acquired or copied correctly, which can cause issues with OCSP validation and caching.

3

Ok, many thanks.