ACE WAF - intermediate certificate

[Martin Kyrc]

Hello,

I have SSL terminated on ACE WAF. New certificate for service is generated with intermediate certificate and for clients is untrusted. Is it possible import CA chain for intermediate certificate on WAF (how?) or is it not possible? I can't find no information about intermediate cert chain import on WAF.

WAF version: 6.0.3

--

martin

[Nicolas Fournier · Accepted solution]

Hi Martin,

You should be able to import the root/intermediate certificates from Resources > Trusted Certificate Authorities.

Once it is done, the WAF should automagically add them to the chain once a client connect.

In case it does not, this is most then likely due to the following bug:

CSCsx19437    If "SSLVerifyClient" global setting is set to "none", an AXG acting.

Apply the workaround described in the release note of the bug and it will hopefully work:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsx19437

Other option would be to go to 6.1.1 where it is fixed.

Regards,

Nicolas

[Martin Kyrc]

Thank you Nicolas for reply. I have uploaded all necessary 'Trusted Certificate Authority'. Where can I find 'SSLVerifyClient' settings?

regards,

Martin

[Martin Kyrc]

Nicolas,

thank you for tip with SSLVerifyClient (I found it in configuration). Now it is working. Thank you!

--

martin