Last Modified: Oct 07, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 21.1.0, 21.1.0.1, 21.1.0.2
Opened: Sep 21, 2026 Severity: 3-Major
When modifying a Client SSL profile through the BIG-IP Configuration utility, the values shown in the Add SSL Certificate Key Chain dialog may differ from the values applied to the profile You may observe one or both of the following: - The Chain field is saved as None, although the dialog displayed an intermediate certificate - The Certificate and Key fields are saved as default, although the dialog displayed previously configured certificate and key values - The unexpected values appear after the Certificate Key Chain entry is added - No warning indicates that the displayed and submitted values differ
The Client SSL profile may be saved with certificate settings that differ from those displayed in the Configuration utility. Possible effects include: - The configured intermediate certificate chain may be removed - TLS clients may receive an incomplete certificate chain and fail certificate validation - The profile may use the BIG-IP default certificate and key instead of the intended certificate and key - Virtual servers using the affected profile may present an unintended certificate - TLS connections may fail or generate certificate warnings - Administrators may not notice the configuration change because the Add dialog displays the expected values before submission - The data plane is not affected until the modified profile configuration is saved and used by traffic
This issue occurs when all of the following conditions are met: - You manage an LTM Client SSL profile through the BIG-IP Configuration utility (TMUI) - The profile contains a Certificate Key Chain entry - You select and delete that entry - You click Add to create a replacement entry - The Add dialog displays values retained from the deleted entry - You submit the dialog without explicitly reselecting every displayed field The resulting behavior depends on which fields you modify: - If you change Certificate and Key but do not change Chain, Chain may be saved as None - If you do not change any displayed fields, Certificate and Key may be saved as default
Before clicking Add in the Certificate Key Chain dialog, explicitly select every required value, even when the correct value is already displayed: - Select the intended Certificate - Select the intended Key - Select the intended Chain, or explicitly select None if no chain is required - Click Add - Verify the resulting Certificate Key Chain entry before saving the Client SSL profile - Alternatively, configure or verify the Certificate Key Chain using the Traffic Management Shell (tmsh) instead of the Configuration utility After making the change, verify the effective configuration: tmsh list ltm profile client-ssl <profile-name> cert-key-chain tmsh list ltm profile client-ssl repro_cssl cert-key-chain
None