An SSL digital certificate is an electronic key pair that allows devices on a network to exchange data securely, using the public key infrastructure (PKI). PKI is based on public and private cryptographic key pairs used to encrypt and decrypt messages sent between two devices.
The BIG-IP system uses digital certificates with the SSL/TLS protocol to grant authentication to clients on the external network that are generally untrusted. In high-security environments, the BIG-IP system can also use certificates to communicate securely with other systems on the internal network, such as web servers and other BIG-IP systems.
The BIG-IP system can sign a digital certificate in either of two ways:
Once a certificate is installed or created on the BIG-IP system, other BIG-IP administrative users can specify those certificates in BIG-IP SSL profiles to manage SSL application traffic. Moreover, the BIG-IP system uses digital certificates to establish device trust in device service clustering (DSC) configurations.
The BIG-IP system supports multiple cipher suites when offloading SSL operations from a target server on the network. The BIG-IP system can support cipher suites that use these algorithms:
When you generate a certificate request or a self-signed certificate, you specify the type of private key, which determines that specific signing or encryption algorithm that is used to generate the private key.
RSA (Rivest Shamir Adleman) is the original encryption algorithm that is based on the concept of a public and a private key. When a public site attempts to communicate with a device such as the BIG-IP system, the device sends the site a public key that the site uses to encrypt data before sending that data back to the device. The device uses its private key associated with the public key to decrypt the data. Only the device on which the certificate resides has access to this private key.
The RSA encryption algorithm includes an authentication mechanism.
DSA (Digital Signature Algorithm) uses a different algorithm for signing key exchange messages than that of RSA. DSA is paired with a key exchange method such as Diffie-Hellman or Elliptical Curve Diffie-Hellman to achieve a comparable level of security to RSA. Because DSA is generally endorsed by federal agencies, specifying a DSA key type makes it easier to comply with new government standards, such as those for specific key lengths.
When creating certificates on the BIG-IP system, you can create a certificate with a key type of ECDSA (Elliptic Curve Digital Signature Algorithm). An ECDSA key is based on Elliptic Curve Cryptography (ECC), and provides better security and performance with significantly shorter key lengths.
For example, an RSA key size of 2048 bits is equivalent to an ECC key size of only 224 bits. As a result, less computing power is required, resulting in faster, more secure connections. Encryption based on ECC is ideally suited for mobile devices that cannot store large keys. The BIG-IP system supports both the prime256v1 and secp384r1 curve names, although only prime256v1 can be associated with an SSL profile.
You can obtain a certificate for the BIG-IP system by using the BIG-IP Configuration utility to generate a certificate signing request (CSR) that can then be submitted to a third-party trusted certificate authority (CA). The CA then issues a signed certificate.
In addition to requesting CA-signed certificates, you can create self-signed certificates. You create self-signed certificates primarily for testing purposes within an organization.
When you install the BIG-IP software, the application includes a default self-signed certificate. The BIG-IP system also includes a default CA bundle certificate. This certificate bundle contains certificates from most of the well-known CAs.
You can perform this task to view a list of existing digital certificates on the BIG-IP system.
When you use the BIG-IP Configuration utility to view the list of digital certificates that you have installed on the BIG-IP system, you can see information for each certificate.
|Certificate||The name of the certificate.|
|Content||The type of certificate content, for example, Certificate Bundle or Certificate and Key.|
|Common name||The common name (CN) for the certificate. The common name embedded in the certificate is used for name-based authentication. The default common name for a self-signed certificate is localhost.localdomain.|
|Expiration date||The date that the certificate expires. If the certificate is a bundle, this information shows the range of expiration dates that apply to certificates in the bundle.|
|Organization||The organization name for the certificate. The organization name embedded in the certificate is used for name-based authentication. The default organization for a self-signed certificate is MyCompany.|