Forum Discussion

Michael_-_Harr1's avatar
Michael_-_Harr1
Icon for Nimbostratus rankNimbostratus
Mar 18, 2015

Issue with new VeriSign certificate clients unable to access website we went from sha 128 to sha-256

Issue with new VeriSign certificate clients unable to access website we went from sha 128 to sha-256. The F5 is not rendering the site. I can access the server from one server to the other and the site is rendering with correct SSL certificate and information using local host file. I confirmed that the content of the certificate on F5 LTM is correct. Even the health monitors for HTTPS is working properly for the pool.

 

Very strange issue. We are running version 11.4.1 I did wire shark trace the F5 is sending the client a reset. I see nothing in thee trace indicating a certificate issue.

 

Any information would greatly be appreciated. If revert back to old certificate that is to set to expire April 2 2015. All works fine.

 

design

8 Replies

Sort By
  • Alan_Renicor_10's avatar
    Alan_Renicor_10
    Icon for Altocumulus rankAltocumulus
    Mar 18, 2015

    What hardware are you running on? Not seen any issues with sha-256, but we had and issue with a client ssl profile change(removing insecure protocols)under 11.4 Exactly the same issue i.e web page wouldn't always render correctly when backed out everything worked . It only seemed to affect our 2000s and 4000s hardware, In the end we fixed by upgrading to 11.6 HF1. The only thing we could put it down to was a possible issue flagged under SOL15232. Just a thought.

     

    • Alan_Renicor_10's avatar
      Alan_Renicor_10
      Icon for Altocumulus rankAltocumulus
      Mar 18, 2015
      Same as us. Traces weren't obvious for us, only that certain pages didn't render almost like the CSS content had corrupted. If your running HA pair I'd suggest at least upgrading one and failing over to test if you can.
  • Peter_Z's avatar
    Peter_Z
    Icon for Cirrus rankCirrus
    Mar 18, 2015

    another thought:

     

    do you see the same issue in all browsers?

     

    what about testing with CLI-based tools, e.g. curl or openssl? can you get the webpage?

     

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Mar 19, 2015
    1. Are you terminating (or bridging) SSL on the ADC?
    2. The monitors are generally not connecting to the origin web servers the same way a browser would.
    3. Does an SSL Labs report reveal anything?
    4. If you're terminating/bridging, did you update the CA bundle on the ADC?
    5. Are you using iApps? If so, is the iApp creating the SSL profiles?
  • Michael_-_Harr1's avatar
    Michael_-_Harr1
    Icon for Nimbostratus rankNimbostratus
    Mar 19, 2015

    1.Are you terminating (or bridging) SSL on the ADC? SSL is terminating on the server 3.Does an SSL Labs report reveal anything? Does F5 support put it in a lab environment is that what you mean? 4.If you're terminating/bridging, did you update the CA bundle on the ADC? Yes the CA bundle is on the ADC 5.Are you using iApps? No IAPPS

     

    • Alan_Renicor_10's avatar
      Alan_Renicor_10
      Icon for Altocumulus rankAltocumulus
      Mar 19, 2015
      For Point 3 , if your connection is internet facing I beleive Arie is suggesting going to https://www.ssllabs.com/ssltest/ and testing your domain to see if it flags up any issues such as incorrect ca's or possible cipher issues. You can also test your ssl cert and ca's via https://www.sslshopper.com/ssl-checker.html.