Manual Chapter :
Authenticating with SSL Certificates Signed by a Third Party
Applies To:
Show Versions
BIG-IP GTM
- 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Overview: Authenticating with SSL certificates signed by a third party
BIG-IP systems use Secure Sockets Layer (SSL) authentication to verify the authenticity of the credentials of systems with which data exchange is necessary.
BIG-IP software includes a self-signed SSL certificate. If your network includes one or more certificate authority (CA) servers, you can also install SSL certificates that are signed by a third party. The BIG-IP systems exchange SSL certificates, and use a CA server to verify the authenticity of the certificates.
The big3d agent on all BIG-IP systems and the gtmd agent on BIG-IP Global Traffic Manager (GTM) systems use the certificates to authenticate communication between the systems.
About SSL authentication levels
SSL supports ten levels of authentication (also known as certificate depth):
- Level 0 certificates (self-signed certificates) are verified by the system to which they belong.
- Level 1 certificates are authenticated by a CA server that is separate from the system.
- Levels 2 - 9 certificates are authenticated by additional CA servers that verify the authenticity of other servers. These multiple levels of authentication (referred to as certificate chains) allow for a tiered verification system that ensures that only authorized communications occur between servers.
Configuring Level 1 SSL authentication
You can configure BIG-IP systems for Level 1 SSL authentication. Before you begin, ensure that the systems you are configuring include the following:
- A signed certificate/key pair.
- The root certificate from the CA server.
Task Summary
Importing the device certificate
To configure the BIG-IP system for Level 1 SSL authentication,
import the device certificate signed by the CA server.
Note: Perform this procedure
on all BIG-IP systems that you want to handle Level 1 SSL
authentication.
Importing the root certificate for the gtmd agent
Before you start this procedure, ensure that you have the root certificate from your CA
server available.
To set up the system to use a third-party certificate signed by a CA server, replace the
existing certificate file for the gtmd agent with the root certificate of your
CA server.
Note: Perform this procedure on only one BIG-IP
GTM system in the GTM synchronization group. The system automatically
synchronizes the setting with the other systems in the group.
Importing the root certificate for the big3d agent
Before you start this procedure, ensure that the root certificate from your CA server is
available.
Note: Perform this procedure on all BIG-IP systems
that you want to configure for Level 1 SSL authentication.
Verifying the certificate exchange
You can verify that you installed the certificate correctly, by running the following
commands on all BIG-IP systems that you configured for Level 1 SSL
authentication.
iqdump <IP address of BIG-IP you are testing>
iqdump <IP address of BIG-IP peer system, if testing a redundant system configuration>
If the certificate was installed correctly, these commands display a continuous stream of
information.
Configuring certificate chain SSL authentication
You can configure BIG-IP systems for certificate chain SSL authentication.
Task Summary
Creating a certificate chain file
Before you start this procedure, ensure that you have the certificate files from your CA
servers available.
Create a certificate chain file that you can use to replace the existing certificate
file.
- Using a text editor, create an empty file for the certificate chain.
- Still using a text editor, copy an individual certificate from its own certificate file and paste the certificate into the file you created in step 1.
- Repeat step 2 for each certificate that you want to include in the certificate chain.
You now have a certificate chain file.
Importing the device certificate from the last CA server in the chain
Import the device certificate signed by the last CA in the certificate chain.
Note: Perform this procedure on all BIG-IP systems that you want to configure for
certificate chain SSL authentication.
Importing a certificate chain file for the gtmd agent
Before importing a certificate chain file for the gtmd agent, ensure that you have the
certificate chain file available.
Replace the existing certificate file on the system with a certificate chain file.
Note: Perform these steps on only one BIG-IP
GTM in a GTM synchronization group. The system automatically synchronizes
the setting with the other systems in the group.
Importing a certificate chain for the big3d agent
Before importing a certificate chain for the big3d agent, ensure that the certificate
chain file is available.
Note: Perform these steps on all BIG-IP systems that you want to configure for certificate chain SSL
authentication.
Verifying the certificate chain exchange
You can verify that you installed the certificate chain correctly, by running the
following commands on all the systems you configure for certificate chain SSL
authentication.
iqdump <IP address of BIG-IP you are testing>
iqdump <IP address of BIG-IP peer system, if testing a redundant system configuration>
If the certificate chain was installed correctly, these commands display a continuous
stream of information.
