Solved

Need clarification on F5 Big IP SSL profiles Chain and Trusted CAs

Posted on 2011-03-01
3
1,276 Views
Last Modified: 2012-05-11
Hi Team,

   We have a scenario wherein in our organization our CA is expiring and has now been replaced with a new CA.  This new one, however was sent to us together with an intermediate certificate.

  We have just received the PK12 file of one of the certificates which is up for renewal and which has been signed by the new CA (and the intermediate one).  Both the intermediate and new CA are now installed in our F5 box.

   Our question is, once we renew our new certificate from the GUI, we are not sure how to fill in the blanks for "Chain" and "Trusted Certificate Authorities."  Do we:

A. Leave "Chain" as NONE and  for "Trusted Certificate Authorities"  select the intermediate cert

  OR

B. Leave "Chain" as NONE and for "Trusted Certificate Authorities"  select the new CA

  OR

C. For  "Chain" use the intermediate certificate and for "Trusted Certificate Authorities"  select the new CA?

Thanks and regards.




0
Comment
Question by:rleyba828
  • 2
3 Comments
 

Author Comment

by:rleyba828
ID: 35014597
Also, what open SSL command can I use on the F5 to verify that the new cert works fine with it's various uplink "chains of trust"?

thanks.
0
 
LVL 5

Accepted Solution

by:
torvir earned 500 total points
ID: 35014900
I have done like this on my box.
Certificate: <site certificate>
Key: <key for site cert>
Chain: None
Trusted Certificate Authorities: <intermediate certificate>

Regarding your other quiestion I must say I haven't done that verification myself.
I found a link that may shed some light on it.
http://support.f5.com/kb/en-us/solutions/public/6000/400/sol6401.html?sr=13020249
0
 

Author Comment

by:rleyba828
ID: 35016320
Hi,

Thanks for the explanation and the great link. Everything is much clearer now.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to make my old USB printer wireless? 71 150
Google Play app store not being blocked from smartphones 4 30
slow vpn connection 9 34
SOFS cluser offline 3 39
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now