Forum Discussion

Skuba_85554's avatar
Skuba_85554
Icon for Nimbostratus rankNimbostratus
Jul 28, 2009

ssl logs

hi everyone

 

 

we've been using ssl termination for years without any problems, but recently i've implemented client certificate authentication for the first time. it seems to be working well, but we've got one customer who cannot connect to the web site. unfortunately, it's one of those situations where i'm 99% sure the problem is at their end, but they want to know what we can see in our logs. can someone let me know where big ip writes it's client authentication attempts?

 

 

thanks
management
monitoring

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 28, 2009
    I don't think you'll see any connection failure logs. Your best bet for troubleshooting would probably be to capture a tcpdump of the client connection failure and then use ssldump on LTM to decode it. You'll need to start the tcpdump before the TCP connection from the client to VIP is established so you get the initial SSL handshake in the trace. You can then use ssldump to decode it:

     

     

    https://support.f5.com/kb/en-us/solutions/public/7000/800/sol7823.html

     

     

    tcpdump -i 0.0 -s0 -w/var/tmp/client_cert.dmp host CLIENT_IP

     

     

    ssldump -AdneN -r/var/tmp/client_cert.dmp -k/config/httpd/conf/ssl.key/server.key >/var/tmp/client_cert.txt

     

     

    Aaron
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 28, 2009
    Also, make sure to change server.key to the SSL key used in your client SSL profile. If you see just APPLICATION_DATA in the ssldump output, the decryption has failed. If you want help deciphering the output, you might try opening a case with F5 Support.

     

     

    Aaron