Need help passing the cert to the pool member when using client/server ssl profiles

Question

Our application developers are launching Mirth and I've setup a Standard VIP listening on 443, http profile, with client/server ssl profile and an iRule (uri based). The server cert portion is working just fine, but was informed yesterday that they needed the client cert to be passed along to the pool members. After doing some reading, I set both profiles to Proxy SSL. Once I set that, they immediately saw SSL handshake failures. From a SSLDUMP I am seeing the following:

# ssldump -r /var/tmp/proxycap.pcap

New TCP connection #1: 10.144.22.176(53294) <-> 10.144.20.176(443)

1 1 0.0008 (0.0008) C>S SSLv2 compatible client hello

Version 3.3

cipher suites

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_RSA_WITH_AES_256_CBC_SHA256

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384

TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

TLS_DHE_DSS_WITH_AES_256_CBC_SHA256

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

SSL2_CK_3DES

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

TLS_ECDH_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_DSS_WITH_AES_256_CBC_SHA

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLS_RSA_WITH_AES_128_CBC_SHA256

TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

TLS_DHE_DSS_WITH_AES_128_CBC_SHA256

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

SSL2_CK_DES

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

SSL2_CK_RC4

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_DHE_DSS_WITH_AES_128_CBC_SHA

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS_DHE_DSS_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256

TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_DSS_WITH_AES_128_GCM_SHA256

TLS_EMPTY_RENEGOTIATION_INFO_SCSV

Unknown value 0xa7

Unknown value 0xa6

TLS_DH_anon_WITH_AES_256_CBC_SHA256

Unknown value 0xc019

TLS_DH_anon_WITH_AES_256_CBC_SHA

TLS_DH_anon_WITH_AES_128_CBC_SHA256

Unknown value 0xc018

TLS_DH_anon_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_DES_CBC_SHA

SSL2_CK_DES

TLS_DHE_RSA_WITH_DES_CBC_SHA

TLS_DHE_DSS_WITH_DES_CBC_SHA

TLS_DH_anon_WITH_DES_CBC_SHA

TLS_RSA_WITH_NULL_SHA256

Unknown value 0xc006

SSL2_CK_RC2_EXPORT40

Unknown value 0xc010

TLS_RSA_WITH_NULL_SHA

Unknown value 0xc001

Unknown value 0xc00b

Unknown value 0xc015

TLS_RSA_WITH_NULL_MD5

Unknown value 0x1e

Unknown value 0x22

1 2 0.0063 (0.0055) S>C Alert

level fatal

value handshake_failure

1 0.0064 (0.0000) S>C TCP RST

The F5 is a 1600 running 12.1.2 code. let me know if I am overlooking something or there is a better way to perform this for the app team. Thanks.

simon_blakely · Answer

&nbsp;&nbsp;As it appears that the pool member requires information from the client-side client auth certificate, you really need to use:   K72668381:&nbsp;&nbsp;Overview of the SSL Client Certificate Constrained Delegation feature&nbsp;which requires upgrading to 13.1.x&nbsp;  K14065425:&nbsp;&nbsp;Configuring Client Certificate Constrained Delegation (C3D)&nbsp;&nbsp;

mizzouri · Answer

Silly question, what is the latest version of software the 1600 series will support? Thanks again for your quick response!

simon_blakely · Answer

K9476:&nbsp;&nbsp;The F5 hardware/software compatibility matrix&nbsp;1600 - BigIP 12.1.2&nbsp;Get a Virtual Edition License ...

mizzouri · Answer

Alright, back again. We had a 4200 unit lying around which was recently reclaimed from another location. I've wiped it clean and upgraded the software to BIG-IP 15.1.0 Build 0.0.31 Final. I've duplicated the VIP setup from lat time and appending in the C3D pieces to the client/server ssl profiles. I seem to be stuck at the client cert handshake:&nbsp;New TCP connection #3: 10.93.169.32(57353) &lt;-&gt; 10.144.20.10(443)3 1&nbsp;0.0515 (0.0515)&nbsp;C&gt;S&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ClientHello&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Version 3.1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cipher suites&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;compression methods&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;status_request&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;supported_groups&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ec_point_formats&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SessionTicket&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extended_master_secret&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Unknown extension (0x18)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;renegotiation_info3 2&nbsp;0.0526 (0.0010)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ServerHello&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Version 3.1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;session_id[32]=&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cf e2 d9 64 73 36 1d d9 56 ca c2 8c 7b 9e 65 82 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;b8 b5 15 06 e3 01 d1 9a 1a 6c 08 82 8b 6e f5 d0 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cipherSuite&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;compressionMethod&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NULL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extensions&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;renegotiation_info&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ec_point_formats&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;extended_master_secret3 3&nbsp;0.0526 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Certificate3 4&nbsp;0.0526 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ServerKeyExchange3 5&nbsp;0.0526 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CertificateRequest&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certificate_types&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rsa_sign&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certificate_types&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dss_sign&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certificate_types&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ecdsa_sign3 6&nbsp;0.0526 (0.0000)&nbsp;S&gt;C&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ServerHelloDone3 7&nbsp;0.1059 (0.0533)&nbsp;C&gt;S&nbsp;Handshake&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Certificate&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ClientKeyExchange&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CertificateVerify3 8&nbsp;0.1059 (0.0000)&nbsp;C&gt;S&nbsp;ChangeCipherSpec3 9&nbsp;0.1059 (0.0000)&nbsp;C&gt;S&nbsp;Handshake3 10 0.1063 (0.0003)&nbsp;S&gt;C&nbsp;Alert&nbsp;&nbsp;&nbsp;level&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fatal&nbsp;&nbsp;&nbsp;value&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;handshake_failure3&nbsp;&nbsp;&nbsp;0.1063 (0.0000)&nbsp;S&gt;C&nbsp;TCP FIN3&nbsp;&nbsp;&nbsp;0.1342 (0.0279)&nbsp;C&gt;S&nbsp;TCP FINNew TCP connection #4: 10.93.169.32(57354) &lt;-&gt; 10.144.20.10(443)4&nbsp;&nbsp;&nbsp;0.0203 (0.0203)&nbsp;C&gt;S&nbsp;TCP FIN4&nbsp;&nbsp;&nbsp;0.0203 (0.0000)&nbsp;S&gt;C&nbsp;TCP FIN(cfg-sync Standalone)(Active)(/Common)(tmos)# &nbsp;

simon_blakely · Answer

You probably need to capture both the client and server-side handshakes at the same time.

You may be getting a server-side authentication failure when the forged certificate is passed to the pool member.

Forum Discussion

Need help passing the cert to the pool member when using client/server ssl profiles

5 Replies

Recent Discussions

import live updates from version x to version y

Tenant image upgrade

iRule editor partition button does not work

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

Passing Client CAC / Smart Card Cert to Application Server

Client vs Server SSL profile

ASM not passing client cookies to the node servers

Passing Arguments to iCall Scripts

SSL PROFILE - How to use multiple SSL Profile Client in Virtual Server