
Proxies
BIG-IP® Reference Guide 4-93
To verify server certificates from the command line
This option is specified as serverssl server cert on the bigpipe proxy
command line. The following command shows an example.
b proxy <ip>:<service> serverssl server cert require
Specifying traversal of certificate chains
In addition to the option to require or ignore a certificate presented by the
server, SSL-to-Server has an option to specify the maximum number of
certificates that can be traversed in a server certificate chain.
To configure certificate traversal using the Configuration
utility
1. From navigation pane, click Proxies.
2. Click the Add button.
3. In the Authentication depth box, type a whole number. The default
setting is 9.
4. Click Done.
To configure certificate traversal from the command line
On the bigpipe proxy command line, this option is specified as serverssl
authenticate depth, followed by a whole number representing the
maximum number of certificates to be traversed. The following command
shows an example.
b proxy <ip>:<service> serverssl authenticate depth 8
Configuring client-side authentication
This feature offers several options pertaining to client authentication. First,
you can set the basic authentication option, which determines the extent to
which an SSL proxy authenticates a client. Second, you can configure the
SSL proxy to authenticate a client either once per SSL session or also upon
each subsequent reuse of the session. Finally, you can specify the maximum
number of certificates to be traversed in a client certificate chain. The
following two sections explain these options.
Tip
In addition to configuring certificate authentication, you must also
configure the trusted CAs. In so doing, it is recommended that you also
configure the list of advertised CAs, to ensure that all clients know which
CAs are trusted by the proxy. For more information, see Advertising a
Trusted CA list, on page 4-104.
Kommentare zu diesen Handbüchern