Kassinipedia

09 - SSL and TLS on BIG-IP

Se lee en 4 min

09 SSL and TLS on BIG-IP

Most applications behind BIG-IP use HTTPS, so knowing where encryption starts and ends is essential. This note covers the TLS basics, the four SSL deployment modes, Client vs Server SSL profiles, certificates, SNI and the settings that affect security and performance.

TLS basics

  • TLS encrypts traffic between two endpoints. A Certificate Authority (CA) issues the digital certificates that prove a server’s identity.
  • A certificate is sent with its intermediate chain; the client must be able to build a path up to a root CA it trusts.

TLS 1.2 handshake

  1. ClientHello — supported versions, cipher suites, random, SNI (requested hostname).
  2. ServerHello — chosen version and cipher, random; Certificate; key exchange; ServerHelloDone.
  3. ClientKeyExchange, ChangeCipherSpec, Finished.
  4. Server ChangeCipherSpec, Finished → encrypted application data.

TLS 1.3 completes the handshake in one round trip and encrypts the certificate.

Client SSL vs Server SSL profiles

  • SSL Profile (Client) — faces the clients / Internet. BIG-IP presents the certificate and decrypts what clients send.
  • SSL Profile (Server) — faces the pool members / internal network. BIG-IP acts as the TLS client and re-encrypts toward the servers.
  • Most secure built-in parents: clientssl-secure and serverssl-secure.

SSL modes

ModeClient → BIG-IPBIG-IP → serverL7 visible?ProfilesWhen to use
SSL offloading (termination)HTTPSHTTP✅Client SSLRemove crypto load from servers; trusted server network
SSL re-encryption (bridging)HTTPSHTTPS (new session)✅Client SSL + Server SSLNeed L7 features and encryption to the servers (compliance, untrusted network)
SSL pass-throughHTTPSHTTPS (same session)❌None (TCP / FastL4)The server must own encryption; BIG-IP only balances at L4
Proxy SSLHTTPSHTTPS — same handshake, BIG-IP in the middle with the server’s key✅Client SSL + Server SSL with Proxy SSL enabledThe server must authenticate the client certificate itself while BIG-IP still inspects L7

Pass-through limits

With pass-through BIG-IP only sees encrypted bytes: no cookie persistence, no HTTP iRules, no compression, no caching, no WAF.

Certificates on BIG-IP

  • A Certificate Key Chain in the Client SSL profile = certificate + private key + chain (intermediates) + passphrase.
  • Typical lifecycle: generate key + CSR → CA signs → import certificate and chain → attach to the Client SSL profile → attach the profile to the VS.
  • Renewal without downtime: import the new certificate with a new name and update the key chain in the existing profile. New connections use it; existing ones finish normally.
  • Missing intermediate chain is the #1 cause of “certificate not trusted” errors on some clients (phones, Java apps) while desktop browsers work.

SNI — many sites on one VIP

  • Several Client SSL profiles on the same VS, each with its Server Name and certificate.
  • One profile is marked Default SSL Profile for SNI for clients that don’t send SNI.
  • Alternative: one SAN or wildcard certificate.

Security settings

  • Allowed TLS versions: disable SSLv3, TLS 1.0 and TLS 1.1 (Options list or cipher rules).
  • Cipher strings / cipher groups: prefer ECDHE with AES-GCM or ChaCha20.
  • Max Aggregate Renegotiation: limits renegotiations → mitigates SSL renegotiation DoS.
  • Client certificate authentication (mTLS): require a client certificate in the Client SSL profile.
  • OCSP stapling, session resumption/tickets for performance.

Performance

  • RSA 2048 → 4096 bits = more CPU per handshake and fewer licensed TPS (SSL transactions per second). (K6475)
  • ECDSA certificates are much cheaper in CPU than large RSA keys.
  • Offloading SSL is one of the main ways to reduce server load.

Self-check

Q1 — Which entity issues a digital certificate?

Q2 — Which SSL mode does NOT allow BIG-IP to see Layer 7 data?

Q3 — Your manager wants the most secure SSL profiles on both sides. Which two?

Q4 — Where is the HTTPS profile for external connections assigned on the VS?

Q5 — Which SSL profile option helps mitigate DoS attacks against SSL services?

Q6 — What two effects does moving from a 2048-bit to a 4096-bit RSA key have?

Q7 — Some phones say the certificate is untrusted, desktops don't. Most likely cause?

Q8 — When is Proxy SSL the right choice?