SSL/TLS Offload and Certificate Management
Offload and re-encryption
The SSL/TLS domain tests certificate deployment and profile behavior. A Client SSL profile on the virtual server terminates TLS. If the pool expects TLS, a Server SSL profile re-encrypts the server-side connection. Without it, traffic to the pool is cleartext. SSL forward proxy is a separate design for inspecting outbound TLS and requires a signing CA.
Certificates and chain
A client SSL profile needs a certificate and matching private key. The certificate file should contain the leaf certificate and the intermediate CA certificates in order; the root is usually omitted. Import formats include PEM, DER, and PKCS12. A CSR is generated for an external CA. The certificate must cover the name clients use, via CN or SAN, and must be valid at the current time. SNI allows multiple certificates on one virtual server; the default certificate is used when SNI does not match.
Protocols and ciphers
TLS 1.2 cipher configuration uses a cipher list or cipher group; TLS 1.3 uses cipher groups and ignores TLS 1.2 cipher-list entries. Session resumption, OCSP stapling, and CRL checking affect behavior and client experience.
Worked example
Internal users trust an application, but mobile users see a certificate warning. openssl s_client -connect 10.0.0.10:443 -showcerts shows only the leaf certificate. The profile has the leaf but not the intermediate. Some desktop clients cache the intermediate from another site; mobile clients do not. Concatenating the intermediate into the certificate file and updating the Client SSL profile fixes the chain. If the chain is complete, check expiry, SAN, and whether the virtual server is using the intended profile.
Traps
Importing a certificate without its key, or mixing a renewed certificate with an old key. Forgetting the intermediate chain. Testing only from a browser that has cached the chain. Putting TLS 1.3 ciphers in the TLS 1.2 cipher list. Leaving the default certificate as an expiring placeholder. Assuming offload alone encrypts the server side.