Hello Dave,
What version you are running?
Yes, you can check your certs and keys with:
Show crypto files—Displays certificates and keys stored under a context.
This example provides sample output:
switch/C1#show crypto files
Filename File File Expor Key/
Size Type table Cert
-----------------------------------------------------------------------
inter.pem 1992 PEM Yes CERT
rsakey.pem 891 PEM Yes KEY
slot2-1tier.pem 1923 PEM Yes CERT
slot2-2tier.pem 1762 PEM Yes CERT
Crypto verify key certificate—Verifies that the Certificate and key match.
This example provides sample output:
switch/C1#crypto verify rsakey.pem slot2-2tier.pem
Keypair in rsakey.pem matches certificate in slot2-2tier.pem
Here you have a sample about how a END-TO-END SSL should look like:
class-map match-all L4-CLASS-HTTPS
2 match virtual-address 172.16.0.15 tcp eq https
policy-map multi-match VIPs
class L4-CLASS-HTTPS
loadbalance vip inservice
loadbalance policy HTTPS-POLICY
loadbalance vip icmp-reply
loadbalance vip advertise active
appl-parameter http advanced-options http_parameter_map
ssl-proxy server CISCO-SSL-PROXY
policy-map type loadbalance http first-match HTTPS-POLICY
class class-default
serverfarm SF-1
ssl-proxy client CLIENT-SSL-PROXY
serverfarm host SF-1
rserver S1 443
inservice
rserver S2 443
inservice
rserver S3 443
inservice
rserver S4 443
inservice
rserver host S1
ip address 192.168.0.200
inservice
rserver host S2
ip address 192.168.0.201
inservice
rserver host S3
ip address 192.168.0.202
inservice
rserver host S4
ip address 192.168.0.203
inservice
ssl-proxy service CLIENT-SSL-PROXY
ssl-proxy service CISCO-SSL-PROXY
key rsakey.pem
cert slot2-2tier.pem
chaingroup Chaingroup1
ssl advanced-options PARAMETER_SSL
crypto chaingroup Chaingroup1
cert inter.pem
parameter-map type http http_parameter_map
persistence-rebalance
set content-maxparse-length 8192
set header-maxparse-length 8192
parameter-map type ssl PARAMETER_SSL
session-cache timeout 300
queue-delay timeout 1
Here you have a link about it:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/ssl/guide/endtoend.pdf
Can you upload these outputs?
# show stats loadbalance
# show stats http
For the details which I included on the http parameter, here you have some additional details:
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1245246
Setting the Maximum Number of Bytes to Parse for Content
By default, the maximum number of bytes that the ACE parses to check for content is 4096. If a content string exceeds the default value, the ACE drops the packet and sends a RST (reset) to the client browser. You can increase the number of bytes that the ACE parses using the set content-maxparse-length command in HTTP parameter map configuration mode. The syntax of this command is as follows:
set content-maxparse-length bytes
The bytes argument is the maximum number of bytes to parse for the total length of a content string. Enter an integer from 1 to 65535. The default is 4096 bytes.
For example, to set the content maximum parse length to 8192, enter:
host1/Admin(config-parammap-http)# set content-maxparse-length 8192
Setting the Maximum Number of Bytes to Parse for Cookies, HTTP Headers, and URLs
By default, the maximum number of bytes that the ACE parses to check for a cookie, HTTP header, or URL is 4096. If a cookie, HTTP header, or URL exceeds the default value, the ACE drops the packet and sends a RST (reset) to the client browser. You can increase the number of bytes that the ACE parses using the set header-maxparse-length command in HTTP parameter-map configuration mode. The syntax of this command is as follows:
set header-maxparse-length bytes
The bytes argument is the maximum number of bytes to parse for the total length of all cookies, HTTP headers, and URLs. Enter an integer from 1 to 65535. The default is 4096 bytes.
For example, to set the HTTP header maximum parse length to 8192, enter:
host1/Admin(config-parammap-http)# set header-maxparse-length 8192
Jorge
