Question about SSL initiation

[nygenxny123]

it seems that basically you configure ssl proxy client under layer 7 map

and a parameter map if you are concerned about keys

but does the ACE initiatiate based on IP address of the server and not the common name of the website/cert?

and wouldnt this cause an error?

What about Trusted Authorities? how will the ACE know if this is a trusted cert

And key validation

We have implemented ssl initation without any issues with just the "ssl proxy client x" command under layer 7

but now we are having issues with another implementation and the developers are wondering about the questions i just posted

[Daniel Arrondo Ostiz · Accepted solution]

Good afternoon,

it seems that basically you configure ssl proxy client under layer 7 map and a parameter map if you are concerned about keys

Yes, this is the only thing that is required for the most basic setup

but does the ACE initiatiate based on IP address of the server and not the common name of the website/cert?

As you said, the ssl-proxy client is configured under a L7 map, and therefore, you can do any L7 load-balancing decisions before you choose the serverfarm to which the connection will go. At this point you could match on the hostname of the original HTTP request and based on that send the connection to one farm or another

What about Trusted Authorities? how will the ACE know if this is a trusted cert

By default, the ACE will only check if the certificate is a server one and not expired, but you can also configure the ACE to test it against a set of preconfigured certificate authorities. For more details, check http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/ssl/guide/initiate.html#wp1084113

If you have any other questions, please, do not hesitate to contact me again

Regards

Daniel

[nygenxny123]

thx!