Client and server ssl cert location when redirecting to a second VIP (LTM)

Since you're having multiple hosts go to the same VIP, you'll need to have the client cert (your SAN) on the primary VIP, so it can offload the SSL. You could also have the SAN cert on your secondary VIPs and a default cert as the serverssl cert on your primary VIP if you wanted to secure communication to the secondary VIPs (though since it's internal to the device, I don't think that it would matter since the traffic never leaves the BIG-IP between those two).

Regarding inheritance, the VIPs would be set up separately, so they'll each have their own iRules, profiles, etc... Basically they're configurations will be completely separate.

Thanks Michael, from what you've said I'll have the client cert on the primary and the default server side cert on the secondary. That will give me ssl from client to server. Please correct me if what I've said is wrong. Thanks for your advice.

i understand on primary vs, san certificate on clientssl and default on serverssl. on secondary vs, default on both clientssl and serverssl.

default clientssl can be used on secondary vs because on primary vs, server certificate in default serverssl is set to ignore, so it does not ao server authentication (i.e. not checking server certificate from secondary vs).

Ignore: The Ignore setting is the default setting. The BIG-IP system ignores certificates from the server and never authenticates the server.

sol14806: Overview of the Server SSL profile (11.x)