Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the pool members.

SSL certificates are required on pool members because the BIG-IP must complete a TLS handshake with each member when a ServerSSL profile is in use.

A ServerSSL profile causes the BIG-IP to re-encrypt traffic toward the pool members, which requires the pool members to present an SSL certificate during the TLS handshake. By default the ServerSSL profile does not enforce certificate authority validation, so the certificates only need to exist on the pool members - they do not need to be CA-signed unless the ServerSSL profile is explicitly configured with a trusted CA bundle and peer certificate verification enabled.

A CA-issued certificate is not mandatory by default; self-signed certificates are sufficient unless the ServerSSL profile is explicitly configured to verify peer certificates against a trusted CA.

There is no requirement that certificates be generated internally within the hosting company; externally issued or self-signed certificates are both valid depending on the ServerSSL profile's verification settings.