Forum Discussion

Fabou_139732's avatar
Fabou_139732
Icon for Nimbostratus rankNimbostratus
Feb 24, 2016
Solved

SSL Certificate Testing while servers not configured

I have setup an HTTPS VIP and I can see that all the servers are green (connectivity is OK) hence the VIP is showing green as well. The issue is that Apache has not been confgured yet so in theory th...
application delivery
BIG-IP
certificate
LTM
ssl
  • BinaryCanary_19's avatar
    BinaryCanary_19
    Feb 24, 2016

    Yes, it is normal, because the BigIP is a full proxy.

     

    Your client will establish a connection to the bigIP independently, and then the bigip will establish a connection to the backend server. The two are independent, and the client connection will have to complete before bigip establishes a server connection.

     

    Since you have an SSL profile on the VIP, then the client is going the whole length to complete the SSL handshake, and then send the GET request. So you get the ssl certificate warning because you need to trust the certificate in order for the handshake to complete.

     

BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account

Yes, it is normal, because the BigIP is a full proxy.

 

Your client will establish a connection to the bigIP independently, and then the bigip will establish a connection to the backend server. The two are independent, and the client connection will have to complete before bigip establishes a server connection.

 

Since you have an SSL profile on the VIP, then the client is going the whole length to complete the SSL handshake, and then send the GET request. So you get the ssl certificate warning because you need to trust the certificate in order for the handshake to complete.

 

AJ_01_135899's avatar
AJ_01_135899
Icon for Cirrostratus rankCirrostratus
Feb 24, 2016
Are you sure on your first answer? The SSL connection is made from the browser to the VIP. The subsequent proxy connection is made from the F5 to the web server. If the web server connection is not able to be made, in my experience there's a failure to connect. This can be verified with OpenSSL or Fiddler, you should still see an SSL handshake with the VIP even with an invalid cert installed on the web server. Your intermediate cert answer makes much more sense to me.