Improve company productivity with a Business Account.Sign Up

x
?
Solved

Need clarification on F5 Big IP SSL profiles Chain and Trusted CAs

Posted on 2011-03-01
3
Medium Priority
?
1,362 Views
Last Modified: 2012-05-11
Hi Team,

   We have a scenario wherein in our organization our CA is expiring and has now been replaced with a new CA.  This new one, however was sent to us together with an intermediate certificate.

  We have just received the PK12 file of one of the certificates which is up for renewal and which has been signed by the new CA (and the intermediate one).  Both the intermediate and new CA are now installed in our F5 box.

   Our question is, once we renew our new certificate from the GUI, we are not sure how to fill in the blanks for "Chain" and "Trusted Certificate Authorities."  Do we:

A. Leave "Chain" as NONE and  for "Trusted Certificate Authorities"  select the intermediate cert

  OR

B. Leave "Chain" as NONE and for "Trusted Certificate Authorities"  select the new CA

  OR

C. For  "Chain" use the intermediate certificate and for "Trusted Certificate Authorities"  select the new CA?

Thanks and regards.




0
Comment
Question by:rleyba828
  • 2
3 Comments
 

Author Comment

by:rleyba828
ID: 35014597
Also, what open SSL command can I use on the F5 to verify that the new cert works fine with it's various uplink "chains of trust"?

thanks.
0
 
LVL 5

Accepted Solution

by:
torvir earned 2000 total points
ID: 35014900
I have done like this on my box.
Certificate: <site certificate>
Key: <key for site cert>
Chain: None
Trusted Certificate Authorities: <intermediate certificate>

Regarding your other quiestion I must say I haven't done that verification myself.
I found a link that may shed some light on it.
http://support.f5.com/kb/en-us/solutions/public/6000/400/sol6401.html?sr=13020249
0
 

Author Comment

by:rleyba828
ID: 35016320
Hi,

Thanks for the explanation and the great link. Everything is much clearer now.
0

Featured Post

NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

595 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question