Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Jul 15, 2015

SSL Certificate weird issue. (Certificate in the browser shows as "Issued by * and Issued to *")

Hello Folks,

 

I am facing a weird issue with of the customer. Following is the quick background.

 

  1. CSR Generated from F5 for SAN Certification (for eg. *.test.com)
  2. CA provided the Cert.
  3. Installed the Cert on F5 and mapped with correct key.
  4. Configured 2 different Client-SSL Profile for 2 different VSs using the same Certificate / key and Chain. (For eg. ClientSSL-1, ClientSSL-2)

Issue: As per the above scenario, ClientSSL-1 is applied on VIP1, and ClientSSL-2 is applied on VIP2. What happens is, when I try to access the VIP2 using FQDN (for eg. the browser throws Certificate error. When I add an exception in browser and open the Certificate, I see that browser reads the "Issue to" and "Issue by" field as "*" (start / wild card). However, when I have tried to access the VIP (instead FQDN) I got a certificate error again (which is expected) but while seeing the Certificate after adding an exception in the web browser, I could see correct Certificate was fetched (i.e. "Issue to: example.gov.de and Issued by: Verisign").

 

Some validation I have checked after observing above. 1. Pinged to FQDN, verified it is resolving to correct VIP. 2. Cleared and checked VIP statistics, which proved that traffic is hitting the right VS when it shows * certificate. 3. TCPDUMP also shows that when client is accessing the FQDN, it is hitting correct VIP.

 

The strange part is, same certificate and key is attached to another Client-SSL Profile, which is applied to another VS, which words well.

 

I have also tried to map that working client-ssl profile to the weird VIP and it didn't change anything.

 

Any clue?

 

Thank you, Darshan

 

certificate

8 Replies

Sort By
  • Ronald_van_der3's avatar
    Ronald_van_der3
    Icon for Nimbostratus rankNimbostratus
    Jul 16, 2015
    1. Why did you create two separate SSL profiles, this is not necessary unless you need specific settings for VS2 compared to VS1.
    2. What certificate can you find in the TCPDUMP capture?
  • swo0sh_gt_13163's avatar
    swo0sh_gt_13163
    Icon for Altostratus rankAltostratus
    Jul 16, 2015
    1. Well there is no technical reason for this. They already had one Client-SSL Profile applied on VS1, just to keep the objects separate we have created a separate Client-SSL Profile for VS2, in case if we need to implement any VS specific changes in future, it won't affect VS1.
    2. I am yet to take TCPDUMP, will share my findings on this.

    My concern is, why it shows correct Cert while accessing the VIP, and not showing the same while accessing using FQDN? I cleared the statistics while using FQDN, and found that traffic is hitting correct VS.

     

    That left me wondering about the observed behavior.

     

    • Ronald_van_der3's avatar
      Ronald_van_der3
      Icon for Nimbostratus rankNimbostratus
      Jul 17, 2015
      Could you share us the virtual server and ssl profile configuration for the 'non working' VS?
    • swo0sh_gt_13163's avatar
      swo0sh_gt_13163
      Icon for Altostratus rankAltostratus
      Jul 17, 2015
      I will share the the client-ssl and VS properties of non-working VS as and when I get next remote session with client. Also if I use the same working client-ssl Profile (which is applied to VS1) isn't changing the behavior. What I fail to understand is, how it is fetching the correct certificate, if I directly access VIP rather than FQDN. Allow me sometime to share the require information. Thanks Ronald.
  • Ryan_80361's avatar
    Ryan_80361
    Icon for Cirrostratus rankCirrostratus
    Jul 16, 2015

    You don't by chance have your host file configured for the FQDN to point to a different IP? (long shot)

     

    • Ronald_van_der3's avatar
      Ronald_van_der3
      Icon for Nimbostratus rankNimbostratus
      Jul 17, 2015
      Obviously he has tested this, so doesn't look like hosts file issue.. `1. Pinged to FQDN, verified it is resolving to correct VIP`
  • Ryannnnnnnnn's avatar
    Ryannnnnnnnn
    Icon for Altocumulus rankAltocumulus
    Jul 16, 2015

    You don't by chance have your host file configured for the FQDN to point to a different IP? (long shot)

     

    • Ronald_van_der3's avatar
      Ronald_van_der3
      Icon for Nimbostratus rankNimbostratus
      Jul 17, 2015
      Obviously he has tested this, so doesn't look like hosts file issue.. `1. Pinged to FQDN, verified it is resolving to correct VIP`