Forum Discussion

Shadow's avatar
Shadow
Icon for Cirrus rankCirrus
Jun 06, 2023
Solved

Trouble applying GoDaddy certificate to a virtual server

I have created a few virtual servers and applied certs. They work just fine because they are using our internal CA. I have one now that uses a GoDaddy cert. I was provided a GoDaddy pfx file. I impo...
application delivery
certificate
godaddy
ssl
  • Paulius's avatar
    Paulius
    Jun 09, 2023

    Shadow it looks like F5_Design_Engineer is on the same track as me. The F5 is receiving a RST from the backend between it and the server so asymmetric routing or the destination pool member itself.

  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Jun 09, 2023

    Hi Shadow , 

    Now , You Must take a packet capture in both sides ( Client and Server ) sides , I feel that the Backend servers that Reset this traffic not Bigip itself the ssl negotiations went correct from the Client side. 

    Bigip took The client Application Data and forwarded it to Backend server , so most properly the backend server itself restted this traffic for various reasons need to be checked furtherly.

  • Mohamed_Ahmed_Kansoh's avatar
    Mohamed_Ahmed_Kansoh
    Jun 09, 2023

    Hi Shadow , 
    Forget about my last reply , as I saw you captured the Full stream of ( Client and server side ). 

    It's very clear that Rest comes from IPs ( 173.235.20.160 & 161  ) which your Backend servers. 

    I see that your Servers couldn't able to establish 3-way handshake with Bigip , Servers reject the First SYN Packet from Bigip , but the most confusing me how the https health monitor marks your pool as up and at the same time bigip can't establish with servers 3-way handshake on real data traffic. 

    >>> I found something strange to me : 

    Do you see MSS value ? it's 1212 which not the standard , it's very very important to check your backend servers's MTU and the MTU in Bigip server side must be compatable with your backend servers that's why your servers Reset this connections , make sure that MTU matches each side ( Bigip server side and Backend servers ) 

    I will tell you another idea >>> What about take a packet capture for your heath monitor to see while monitoring Bigip sends monitor packet with this MSS = 1212 or not as from your pool configuration I see the Https monitor marks your Backend servers Up and Can establish 3-way handshake correct. 
    So we need to compare between Client traffic on server side and Health monitor traffic on server side as well. 
    Concentrate more in the server side not ssl certificates.

    I will be waiting your results 🙂 

  • Shadow's avatar
    Shadow
    Jun 23, 2023

    I have a ticket open with support and they have confirmed it is not a GoDaddy issue, but rather the backend server. Resets are coming after the redirection. 

     

F5_Design_Engineer's avatar
F5_Design_Engineer
Icon for MVP rankMVP

Shadow ,

 

I have checked your pcap and it seems there is a Checkpoint firewall in between your F5 Internal interface and Backend pool memeber , and Checkpoint is sending RST packets.

Can you try change server ssl profile to serverssl-secure?

Your environment seems F5 is intalled on a VMWARE and there is a checkpoint firewall between F5 and backend real server.

Here are the screenshots from your tcpdump in wireshark

Can you check if there is a Checkpoint firewall in between:

I have checked the SSL certificate details here:

 

SSL Server Test: ssl.afbic.com (Powered by Qualys SSL Labs)

Attached is the pdf below for full report .

Check for SSL packets drop on Checkpoint.

One more point I noticed in your CURL output:

Application-Layer Protocol Negotiation (ALPN) is a Transport Layer Security (TLS) extension for application layer protocol negotiation. ALPN allows the application layer to negotiate which protocol should be performed over a secure connection in a manner that avoids additional round trips and which is independent of the application layer protocols. It is needed by secure HTTP/2 connections, which improves the compression of web pages and reduces their latency compared to HTTP/1.x.

Since APLN is an extension of TLS, it implies that TLS is being used. Even if the server is not using ALPN, but some other earlier protocol, both protocols must be extensions of TLS or they would not be able communicate.

In the above verbose output, "ALPN," is a prefix indicating that the rest of the line is the status of ALPN negotiation by the client side.

 

 

 

 

Shadow's avatar
Shadow
Icon for Cirrus rankCirrus
Jun 09, 2023

I chaned the profile to serverssl-secure and got the same results.

The networking team is telling me there is no checkpoint firewall.