Extra Certs..Inbound Decryption

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Extra Certs..Inbound Decryption

L4 Transporter

We have PA doing inbound decryption in front of F5 which is proxying a web server.

F5 is doing SSL bridging. That is it terminates the SSL connection and starts new connection to the server from itself.

Website itself works fine.

 

When we do SSLlabs test on it we get extra certs error. I am not sure why the certificates are being duplicated.

On clicking the download server chain link on the side of the result we get dual entries for the cert. Its duplicating both the server cert and intermediate cert making it 4 where it should be only be 2 certs.

 

 

image.png

 

NGFW SSL Decryption 

 

1 accepted solution

Accepted Solutions

Hi @raji_toor ,

Theoretically speaking even with both devices doing SSL decryption, it make more sense for the firewall to do something strange, because SSL decryption is basically absolutely the same as F5 bridging - Firewall will build to separate SSL connection (one with the client and one with the server, which in your case the F5 VIP).

 

For the connection between FW and the client (in your tests the SSLlabs) firewall will act as a server and will provide the SSL certificate that you have imported to the FW for the Inbound SSL decryption.

For the connection between the FW and the F5 it will act as client so it will only try to validate the cert that F5 is sending - it shouldn't do anything with that, nor forward it to the client.

 

So as a starting point it sound reasonable to double check the certificate that you have imported to the firewall. Most simple check would be

1. Export the certificate in PEM format (you don't have to export the private key)

2. Open the file with text editot (notepad, notepad++ etc)

3. Check how many "BEGIN CERTIFICATE" and "END CERTIFICATE" sections you have

4. Open the file like certificate (double click on the file), go to "certification path" and compare how many cert do you see in  that three with the number of cert sectiond do you see in the text editor. Are they matching?

View solution in original post

2 REPLIES 2

Hi @raji_toor ,

Theoretically speaking even with both devices doing SSL decryption, it make more sense for the firewall to do something strange, because SSL decryption is basically absolutely the same as F5 bridging - Firewall will build to separate SSL connection (one with the client and one with the server, which in your case the F5 VIP).

 

For the connection between FW and the client (in your tests the SSLlabs) firewall will act as a server and will provide the SSL certificate that you have imported to the FW for the Inbound SSL decryption.

For the connection between the FW and the F5 it will act as client so it will only try to validate the cert that F5 is sending - it shouldn't do anything with that, nor forward it to the client.

 

So as a starting point it sound reasonable to double check the certificate that you have imported to the firewall. Most simple check would be

1. Export the certificate in PEM format (you don't have to export the private key)

2. Open the file with text editot (notepad, notepad++ etc)

3. Check how many "BEGIN CERTIFICATE" and "END CERTIFICATE" sections you have

4. Open the file like certificate (double click on the file), go to "certification path" and compare how many cert do you see in  that three with the number of cert sectiond do you see in the text editor. Are they matching?

@aleksandar.astardzhiev Thanks for pointing that out, When I checked the PEM file it had duplicate entries from flawed conversion before importing. On correcting this  and reimporting it works as expected.

  • 1 accepted solution
  • 2499 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!