Assume a virtual server has a ServerSSL profile. What SSL certificates are required on the pool members.

Pool members must present an SSL certificate if the BIG-IP is using a ServerSSL profile to re-encrypt connections, as the BIG-IP acts as an SSL client in this scenario.

For a BIG-IP with a ServerSSL profile, the BIG-IP acts as an SSL client to the pool member. It only verifies that the pool member presents some SSL certificate for the connection to proceed; it does not typically validate the certificate chain against a CA unless specifically configured to do so for client-side authentication.

While certificates issued from a CA are standard, the BIG-IP's default ServerSSL behavior only requires a certificate to exist on the pool member, not necessarily one signed by a publicly trusted CA.

The origin of the certificate (whether internal or external) is irrelevant; any valid certificate, even self-signed, will satisfy the default ServerSSL profile's requirement.