Does using default clientssl profile disable SSL offload for the VIP?

[Vishal_Sinha]

I have a VIP that is using client ssl profile with default (localhost) certificate. my pool members for this VIP have the Certificate for this URL.

I see the certificate when i access the VIP.

I believe that i should receive a certificate error if SSL offloading is enabled on F5 but i dont see the error.

Why is that?

[Mayur_Sutare]

Can you check which certificate are you getting on the browser? when accessing VIP?

[Vishal_Sinha]

i see a certificate that is installed on the pool member server. its a certificate issued by our Internal CA, and the VIP URL is included as SAN in that certificate.

[Mayur_Sutare]

If you have configured client SSL profile on the VS then client should get certificate present in the client SSL profile attached to the VS not the certificate present on the pool member. Are you sure if request is hitting correct VS?

[Vishal_Sinha]

yes, VIP has a Client SSL profile and i have default localhost certificate called in it. I have verified that we are hitting the right VIP. i did the tcpdump and saw the hits.

i am seeing this thing on many of my F5s that have default certificate called in the Client SSL Profile.