Forum Discussion

elamri_304806's avatar
elamri_304806
Icon for Nimbostratus rankNimbostratus
Jun 29, 2017
Solved

Common name SSL F5

hello team,

 

I have a problem with a certification deployed on F5.

 

Currently this certification have the CN : lab1.mycompany.lan

 

So the problem is when i change the link of my application to lab2.mycompany.lan that use the profil of certification "CN:lab1.company.lan" i can access despite the web address is different.

 

At my knowledge, the Common Name must be the same as the Web address you will be accessing when connecting to a secure site

 

Could you please help me to solve this issue ?

 

application delivery
BIG-IP
LTM
security
ssl
  • Ashwin_Venkat_1's avatar
    Ashwin_Venkat_1
    Jun 29, 2017

    If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.

     

    None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.

     

    However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452

     

6 Replies

Sort By
  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jun 29, 2017

    So, lab2.mycompany.lan is using lab1.mycompany.lan certificate but you are seeing no errors ? If so, may be wild-card certificate or multiple domain certificate ? Did you check to make sure the traffic is flowing to the right resource ?

     

  • Ilian_Ivanov's avatar
    Ilian_Ivanov
    Icon for Nimbostratus rankNimbostratus
    Jun 29, 2017

    Hello,

    It is normal that you can access your site from different URLs, even it is SSL and you have only 1 CN. You can have a lot of DNS entries pointing to the same location. But if the certificate CN is lab1.mycompany.lan you will get certificate warning when you try with lab2.mycompany.lan. You can skip the warning and continue to the site.

    If you want that site to be reached only from URL- lab1.mycompany.lan, you will need to use an iRule like that one:

    when HTTP_REQUEST {
if { [HTTP::host] equals "lab1.mycompany.lan" } {
    pool myhttppool
    }
else {
    drop
}
}
  • Ashwin_Venkat's avatar
    Ashwin_Venkat
    Icon for Employee rankEmployee
    Jun 29, 2017

    If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.

     

    None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.

     

    However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452

     

  • Ashwin_Venkat_1's avatar
    Ashwin_Venkat_1
    Historic F5 Account
    Jun 29, 2017

    If you access a website that has a different hostname compared to the Common Name specified in the certificate, you will be able to access the site without any issues but you must be getting a warning message on your browser that says the certificate presented to you by the server (F5, in this case) is dedicated to a different hostname.

     

    None of this should prevent your website from loading, but the untrusted warning message will continue to persist until you rectify that to match the certificate common name. To address this, one way to do it is have a wildcard certificate with CN: *.mycompany.lan and apply this to your profile.

     

    However, if you want to have dedicated certificate for "lab2.mycompany.lan" and use the other wildcard certificate for all other subdomains of mycompany.lan, then you can make use of our Server Name Indication feature: https://support.f5.com/csp/article/K13452