How is certificate verification done? Will monitor fail if server has invalid certificate?
I am trying to setup a HTTPS Monitor for a website. In Postman I have tested the the 'GET" as follows 'https://XXXXXXX.com/YYYYYYYYYY/ZZZZZZ HTTP/1.1\r\nHost:xxxxxxxxxx.com\r\nConnection: Close\r\n\r\n' It successfully returns a Status of 200 OK
I have created the following Monitor in F5. This is a Production site so want to double-check accuracy for monitor before applying.
Send String - https://xxxxxxxx.com/yyyyyyyy/zzzzzz HTTP/1.1\r\nHost: xxxxxxxxxx.com\r\nConnection: Close\r\n\r\n
Receive String - 200 OK
Should the above Monitor work or should I change something in it before testing further on F5?
Any comments would be appreciated.
HTTPS Monitor allows you to establish a TLS connection with back-end server.
By default, no certificate verification is done on BIG-IP so basically if TLS handshake works fine and the receive string is what we configured as expected response, monitor should be marked as UP.
If you want BIG-IP to verify server's certificate then you can attach a Server SSL profile to your HTTPS monitor and then on Server Authentication, change Server Certificate to Require and add a file with your trusted CAs (who will verify server’s certificate identity) to Trusted Certificate Authorities.
Trusted Certificate Authorities is a single certificate file (*.crt) with one Root CA or concatenated file with 2 or more Root CAs to confirm server certificate (seen in server-side Certificate message) is trusted by BIG-IP.
Notice that BIG-IP has a pre-defined bundle (ca-bundle.crt) which contains a list of well-known trusted Root CAs similar to the ones in browsers like Firefox:
root@(v13)(cfg-sync In Sync)(Peer Time Out of Sync)(/Common)(tmos)# modify ltm profile server-ssl myserverssl2 ca-file ca? Configuration Items: ca-bundle.crt
If you need to do client authentication, i.e. Server to authenticate BIG-IP as a client, you can additionally add a Certificate and Key to Client Certificate Constrained Delegation section.
Hope that's clear enough.