Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the BIG- IP.

The ServerSSL profile causes the BIG-IP to initiate new SSL connections to pool members, where the SSL certificate is presented by the backend server - not the BIG-IP. Because the BIG-IP is the client in this exchange, no certificate needs to be installed on the BIG-IP itself, though it can optionally be configured to validate the server's certificate.

Stating that the BIG-IP's SSL certificates must 'only exist' is incorrect because no SSL certificate is required on the BIG-IP at all when using only a ServerSSL profile.

There is no requirement for CA-issued certificates on the BIG-IP when using a ServerSSL profile, since the certificate resides on the backend server and the BIG-IP acts purely as the SSL client.

Certificates do not need to originate from the company hosting the BIG-IP for a ServerSSL profile; in fact, no certificate installed on the BIG-IP is needed for this profile type.