Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the BIG- IP?

A ServerSSL profile on a BIG-IP virtual server means the BIG-IP is initiating an SSL connection to the backend pool member. In this role, the BIG-IP acts as an SSL client. An SSL client typically only needs to trust the server's certificate (via CA certificates installed on the BIG-IP) but does not require its own client certificate unless the backend server is explicitly configured for mutual SSL authentication.

The BIG-IP's own SSL certificates are generally required for ClientSSL profiles, where the BIG-IP acts as a server, or if mutual SSL is enabled for ServerSSL.

Certificates issued from a CA would be needed if the BIG-IP were presenting itself as a server (ClientSSL) or for mutual SSL, but not for basic ServerSSL where it acts as a client.

The origin of the BIG-IP's SSL certificates is irrelevant if no certificates are needed at all for the specified ServerSSL profile use case.