Symptoms

When an HTTPS monitor used a server SSL profile configured with peer-cert-mode set to require, in-TMM monitors correctly rejected expired certificates, but BIGD-based monitors accepted them

Impact

When a pool member certificate expires, the HTTPS monitor still has a good transaction and sets the pool member state to UP. For the in-tmm monitor, it failed to make an SSL handshake and set the pool member state to DOWN

Conditions

Steps to Reproduce: Configure: ltm profile server-ssl serverssl-1 { app-service none ca-file backend_selfsigned_ca peer-cert-mode require } ltm monitor https https-1 { adaptive disabled defaults-from https destination *:* interval 5 ip-dscp 0 recv none recv-disable none send "GET / HTTP/1.1\r\n\r\n" ssl-profile /Common/serverssl-1 time-until-up 0 timeout 16 } ltm pool pool-1 { members { 10.1.1.200:irdmi { address 10.1.1.200 session monitor-enabled state down } } monitor https-1 } sys db bigd.tmm { value "disable" } Hint: - peer-cert-mode must be configured to "required". Its default is ignored. If it is ignored, the in-tmm monitor does not care if the certificate is expired or not - If peer-cert-mode is configured to "required", it does not accept self-signed certificates by default. So we need to create a ca-file from the certificate file cert.pem and configure to ca-file of serverssl Steps to configure the ca-file are: - scp cert file (cert.pem or cert_exp.pem) to BIG-IP /shared/ - install sys crypto cert selfsigned_ca from-local-file /shared/cert.pem - modify ltm profile server-ssl serverssl-1 ca-file selfsigned_ca Then okay to make SSL traffic with a valid certificate Verify Steps: - Generate valid certificate and expired certificate ** generate valid certificate: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes ** generate expired certificate: # 1) Generate key + CSR openssl req -new -newkey rsa:2048 -nodes \ -keyout key_exp.pem \ -out cert_exp.csr \ -subj "/CN=localhost" # 2) Self-sign CSR with explicit past validity window (expired cert) openssl x509 -req \ -in cert_exp.csr \ -signkey key_exp.pem \ -out cert_exp.pem \ -startdate 20200101000000Z \ -enddate 20200102000000Z - Start SSL server with valid certificate openssl s_server -cert cert.pem -key key.pem -accept 8000 If a monitor is added to the pool, you should see something like that -----BEGIN SSL SESSION PARAMETERS----- MH8CAQECAgMDBALALwQgK4cBz7kd1uU7vIK5463zue92H5Jv/6l3T4UgciiR6FUE MPENptbh0MVh4S9SZUzRZLZeFVJeZ4kxdH4MYESJjzcYPku85nEyf6/SmA6qZZs7 XaEGAgRqKyVrogQCAhwgpAYEBAEAAACtAwIBAbMDAgEX -----END SSL SESSION PARAMETERS----- Shared ciphers:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA:AES256-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256 Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1 Shared Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224 Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2 Supported groups: secp256r1:secp521r1:brainpoolP512r1:brainpoolP384r1:secp384r1:brainpoolP256r1:secp256k1 Shared groups: secp256r1:secp521r1:secp384r1 CIPHER is ECDHE-RSA-AES128-GCM-SHA256 Secure Renegotiation IS supported GET / HTTP/1.1 - Switch between in-tmm monitor and bigd monitor using "tmsh modify sys db bigd.tmm value enable/disable". enable is in-tmm monitor, disable is bigd monitor. If the certificate is valid, both work fine - stop that SSL server and start SSL server with expired certificate openssl s_server -cert cert_exp.pem -key key_exp.pem -accept 8000 - then switch between in-tmm monitor and bigd monitor. If it is the in-tmm monitor, there is nothing received at the server. If it is the bigd monitor, there is still "GET / HTTP/1.1" at the server

Workaround

None

Fix Information

BIGD HTTPS monitors now honor the certificate verification settings from the associated server SSL profile, including peer-cert-mode and the configured CA file. BIGD monitors reject expired or otherwise invalid server certificates when certificate verification is required. As a result, BIGD and in-TMM HTTPS monitors now provide consistent certificate-validation behavior

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips