Forum Discussion

atoth's avatar
atoth
Icon for Cirrus rankCirrus
Aug 28, 2019

Mutual SSL not working as intended?

I have a vip I'm working on. It had 1-way SSL offloading enabled on the it, and I enabled 2-way SSL by creating a Client CA file with 2 domains tuv.com and xyz.com along with their respective CA certs and enabling the file on the client-ssl profile, along with the settings authenticate always, and peer-cert-mode required.

 

Now the customer is coming back to me saying its not exactly working as intended. If he does a curl to the vip, and he supplies cert abc.com, cacert bundle and key, he's getting through.

 

something like this

curl --cert abc_com.crt:<password> --key abc_com.key --cacert abc_com-INT.crt https://myvip.com

 

Now my understanding is that with mutual SSL, only clients with the certs of tuv.com and xyz.com should be allowed to access the vip. I asked the customer to use openssl -s_client to connect to the vip with the credentials for abc.com, but I'm having a hard time trying to tell whether it was or wasn't from the output.

 

Does anyone know of anything that can explain this behavior?

BIG-IP
LTM
security

2 Replies

Sort By
  • atoth's avatar
    atoth
    Icon for Cirrus rankCirrus
    Aug 30, 2019

    I've tried changing the client ca-file to only have the base certs for tuv.com and xyz.com and not their respective CA certs. This prevents curl access even if you're using the certs for tuv.com and xyz.com.

     

    I'm having a really hard time find documentation for the expected behavior for 2-way SSL. If anyone knows a good source I'd appreciate it.

     

    Besides that, I'd like to know the official purposes of the ca-file and the client ca-file fields in the clientssl profile.

     

    For 2-way, my understanding is that they're act as a whitelist for what client certs can and cannot access the vip. But this seems to not be the case as my post above seems to show. This is either a massive bug, or the intended behavior, and I'm somehow leaning on the latter.

     

    If this is not a way to only allow certain sites to access your vip, what would be the best way to do so?