I85PREP
⌘ K
CCA-AppDS Traffic Management (1Y0-241) study materials
CCA-AppDS Traffic Management (1Y0-241) study resources

CCA-AppDS Traffic Management (1Y0-241): SSL Offloading and Certificate Management

CCA-AppDS Traffic Management (1Y0-241) · Work through your exam, one topic at a time.

All guide sections

SSL Offloading and Certificate Management

Offload, bridge, or pass through

SSL offloading terminates TLS on an SSL vserver and sends clear text to an HTTP service. SSL bridging terminates client TLS and re-encrypts to an SSL service, which is common when backend encryption is required. SSL pass-through does not terminate TLS at the ADC; a TCP vserver forwards encrypted traffic, so the ADC cannot inspect HTTP or apply HTTP policies. An SSL vserver needs a server certificate and private key; an SSL service needs its own certificate if the backend requires the ADC to act as a client.

Certificate objects and chain building

  • add ssl certKey installs a certificate and key pair.
  • bind ssl vserver attaches the certificate to the front-end SSL vserver.
  • link ssl certKey links an intermediate or issuer certificate so the ADC can present a complete chain.
  • SNI allows multiple certificates on one SSL vserver; the client's hostname selects the certificate.
  • Cipher groups and SSL profiles control protocol versions and ciphers; front-end and back-end profiles are separate.
  • Certificate expiry monitoring and CSR generation are part of routine certificate management.

Worked example

A client connects to https://shop.example.com. The SSL vserver is bound to a certificate for shop.example.com, but the server sends only the leaf certificate. Browsers that do not already cache the intermediate fail chain building, even though the leaf is valid. The fix is to install the intermediate certificate as a certKey and link it to the leaf, then bind the leaf certKey to the SSL vserver. If the same VIP must also serve pay.example.com, bind a second certificate and enable SNI. If the backend must be encrypted, change the service to SSL and bind a backend certificate or configure the service to not verify the server certificate only when policy allows it.

Traps

Binding a certificate to the HTTP service does not secure the front end; the certificate belongs on the SSL vserver. A missing intermediate is not a cipher problem. Do not confuse an SSL vserver with an SSL service: the former terminates client TLS, the latter initiates backend TLS. SNI is not active just because multiple certificates are installed; it must be enabled. Mismatched cipher groups between client and ADC produce handshake failures that look like application outages.