Dell 3-DNS Especificaciones descargar pdf (Pagina 183)

Proxies

BIG-IP® Reference Guide 4 - 103

4. If the file is still not found, the proxy uses the same file name as that

of the configured certificate. For example, the proxy might take the

file name www.dot.com.crt, replace the .crt file name extension

with the .chain extension, and search on the file name

www.dot.com.chain.

5. If unable to build the certificate chain using the preceding

procedure, the proxy attempts to build the chain through certificate

verification, described in the following section.

To build a certificate chain using the Configuration utility

1. In the navigation pane, click Proxies.

2. Click the Add button.

3. In the box Client Chain File or Server Chain File, either select the

name of a Trusted CAs file from the box, or type the name of a

Trusted CA file.

4. Click Done.

To build a certificate chain from the command line

To build a certificate chain from the command line, type the bigpipe proxy

command with the appropriate arguments, as follows:

b proxy <ip>:<service> [clientssl] chain <clientside chain file name>

b proxy <ip>:<service> serverssl chain <serverside chain file name>

Verifying certificates

For both client-side and server-side SSL processing, you can configure the

SSL proxy to verify certificates. Using either the Configuration utility or the

bigpipe proxy command, you can specify both a Trusted CA file name and

a Trusted CA path name, which the proxy then uses to verify client

certificates.

Certificate verification is useful for the following reasons:

• To authenticate the proxy’s peer

• To build a certificate chain to be sent to a peer, when the standard

method for building a certificate chain fails

The Trusted CA file.

The Trusted CA file that you specify to configure certificate verification

contains one or more certificates, in PEM format. If you do not specify a

Trusted CA file, or the specified Trusted CA file is not accessible to the

proxy, the proxy uses the default file name

/config/bigconfig/ssl.crt/intermediate-ca.crt.

The Trusted CA path.

When searching a Trusted CA path, the proxy only examines those

certificates that include a symbolic link to a certificate file. To ensure that

each certificate has a link to its corresponding certificate file, you can

1 2 ... 178 179 180 181 182 183 184 185 186 187 188 ... 425 426

Sin comentarios

Dell 3-DNS Especificaciones Pagina 183