201 · Question #275
Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the pool members?
The correct answer is B. The pool members.SSL certificates must only exist. When a Virtual Server has a ServerSSL profile, the pool member must present an SSL certificate for the BIG-IP to establish a secure backend connection, even if the BIG-IP is configured to bypass strict certificate validation.
Question
Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the pool members?
Options
- ANo SSL certificates are required on the pool members.
- BThe pool members.SSL certificates must only exist.
- CThe pool members.SSL certificates must be issued from a certificate authority.
- DThe pool members.SSL certificates must be created within the company hosting the BIGIPs.
How the community answered
(52 responses)- A2% (1)
- B92% (48)
- C2% (1)
- D4% (2)
Why each option
When a Virtual Server has a ServerSSL profile, the pool member must present an SSL certificate for the BIG-IP to establish a secure backend connection, even if the BIG-IP is configured to bypass strict certificate validation.
Applying a ServerSSL profile dictates that the BIG-IP will perform SSL encryption to the backend, which fundamentally requires the backend server to present an SSL certificate.
If a ServerSSL profile is applied, the BIG-IP system acts as an SSL client to the backend pool member, meaning the pool member must present an SSL certificate to initiate the TLS handshake. While the BIG-IP can be configured to trust any certificate, the certificate must at least exist for the connection to be established.
Concept tested: Server-side SSL/TLS with BIG-IP ServerSSL profile
Source: https://techdocs.f5.com/en-us/big-ip-aom-16-1-0/big-ip-system-administration/managing-ssl-profiles.html
Topics
Community Discussion
No community discussion yet for this question.