SSL/TLS Termination, Certificate Management, and Client/Server SSL Profiles
Domain 4 - SSL/TLS Termination, Certificate Management, and Client/Server SSL Profiles
This domain tests where TLS ends, how certificates are managed, and how client-side and server-side SSL differ.
Termination models
With a client SSL profile, the BIG-IP terminates the client TLS connection, decrypts, applies LTM, ASM, or iRules, then can re-encrypt to the pool with a server SSL profile. This is full termination. SSL pass-through forwards encrypted traffic without decryption; it cannot inspect HTTP. SSL bridging decrypts and re-encrypts. A server SSL profile applies to the server-side leg, so the BIG-IP can present or validate certificates with pool members.
Certificate management
Objects include SSL certificates, private keys, certificate chains, and CSRs. The certificate must match the key; the chain should include intermediates but not the root. Client SSL profiles set certificate, key, chain, ciphers, TLS versions, SNI, and client certificate validation. Server SSL profiles set the client certificate presented to servers and server certificate validation. OCSP stapling and CRL checks affect revocation. Expired, incomplete-chain, or hostname-mismatch certificates cause handshake failures.
Worked example
A virtual server 198.51.100.20:443 has client SSL profile clientssl with certificate CN=www.example.com and server SSL profile serverssl that trusts the backend CA. A client opens TLS; BIG-IP completes the handshake using the client SSL profile. It then opens a new TLS connection to 10.0.0.21:443, validates the backend certificate against the server SSL profile's CA, and sends the request. If the backend certificate is expired, the server-side handshake fails even though the client-side handshake succeeded.
Traps
- Putting the server SSL profile in the wrong direction; it governs the BIG-IP to pool-member leg.
- Forgetting the intermediate chain; browsers may fail while partial-trust command-line tools succeed.
- Confusing SNI with a wildcard certificate; SNI selects a profile or certificate by hostname.
- Assuming pass-through allows HTTP iRules or ASM inspection.
- Mismatching TLS versions or ciphers between client and server profiles.
- Ignoring certificate expiry and revocation during planned maintenance.