ACE SSL Initiation - no check of server cert?

SW 3.0(0)A1(4)
I've configured SSL initiation and noticed that a successful session is established despite no valid root CA cert installed on the ACE.
Does client SSL just work regardless without any cert validation?

this is currently how it works.
It will change in version 2.0
Gilles.

Similar Messages

ACE SSL initiation via Proxy server (squid)

Hi,
is it possible to configure ACE with SSL initiation if the connection goes via http/https proxy (squid) ?
I mean local host is requesting http://xyz.com, ACE doing SSL and requesting https://xyz.com, not directly but via http/https proxy server (squid).
Thanks

Hi Ryszard,
Yes, ACE can initiate SSL traffic and maintain SSL connection. So in SSL initiation ACE will act as a CLIENT receiving clear text HTTP traffic at the front end and sending traffic encrypted over the backend.
For more details please visit the below link and let me know if you have any questions.
http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/ssl/guide/sslgd/initiate.html#wp1010343
Regards,
Kanwal

ACE ssl initiation

Have done ssl init on the CSS before.
It can be easily configured to present a client cert to the remote end like a browser would.
I can't see how this is done on the ACE.
Do I just apply an authgroup referring to the client cert in the ssl proxy configuration ?

Hi,
For SSL intiation ACE shall act as a client. So you will define a SSL-Proxy and just bind it with the policy map.
Below config is for end-to-end SSL but look at bold part that is for SSL initiation and here is the link for your reference.
access-list allow_all line 10 extended permit ip any any
probe http KEEPALIVE-WEBS
description Test for Webs Servers
interval 15
passdetect interval 30
request method head url /ping.jsp
expect status 200 200
parameter-map type ssl ssl_ciphers
cipher RSA_WITH_RC4_128_MD5
cipher RSA_WITH_RC4_128_SHA
cipher RSA_WITH_DES_CBC_SHA
cipher RSA_WITH_AES_128_CBC_SHA
cipher RSA_WITH_AES_256_CBC_SHA
rserver host WEB001
description Web Servers
ip address 10.0.130.253
probe KEEPALIVE-WEBS
inservice
rserver host WEB002
description Web Servers
ip address 10.0.130.252
probe KEEPALIVE-WEBS
inservice
rserver host WEB003
description Web Servers
ip address 10.0.130.254
probe KEEPALIVE-WEBS
inservice
rserver redirect OLD_SITE_REDIR
webhost-redirection
https://www.newsite.com 301
inservice
ssl-proxy service SERVER_SSL
key www-server.key
cert www-server.crt
ssl advanced-options ssl_ciphers
ssl-proxy service CLIENT_SSL
   ssl advanced-options ssl_ciphers
serverfarm redirect REDIRECT
rserver OLD_SITE_REDIR
    inservice
serverfarm host VIP-WWW-443
description servers-for-https
rserver WEB001 443
    inservice
rserver WEB002 443
    inservice
rserver WEB003 443
    inservice
serverfarm host VIP-WWW-80
description servers-for-www
rserver WEB001 80
    inservice
rserver WEB002 80
    inservice
rserver WEB003 80
    inservice
sticky http-cookie wwwservers WWW-P80
cookie insert
timeout 720
replicate sticky
serverfarm VIP-WWW-80
sticky http-cookie wwwservers WWW-P443
cookie insert
timeout 720
replicate sticky
serverfarm VIP-WWW-443
class-map type http loadbalance match-all CLA7REDIR
2 match http url http://www.oldsite.com/.*
class-map type http loadbalance match-all CLA7WWW
2 match http url http://www.newsite.com/.*
class-map match-any VIP-P443
2 match virtual-address 10.0.128.211 tcp eq https
class-map match-any VIP-P80
2 match virtual-address 10.0.128.211 tcp eq www
policy-map type loadbalance first-match VIP_SERVER_P443
class CLA7REDIR
    serverfarm REDIRECT
class CLA7WWW
    sticky-serverfarm WWW-P443
    ssl-proxy client CLIENT_SSL
policy-map type loadbalance first-match VIP_SERVER_P80
class class-default
    sticky-serverfarm WWW-P80
policy-map multi-match WWW_LB
class VIP-P80
    loadbalance vip inservice
    loadbalance policy VIP_SERVER_P80
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
class VIP-P443
    loadbalance vip inservice
    loadbalance policy VIP_SERVER_P443
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    ssl-proxy server SERVER_SSL
interface vlan 128
ip address 10.0.128.15 255.255.255.0
access-group input allow_all
service-policy input WWW_LB
no shutdown
interface vlan 130
ip address 10.0.130.15 255.255.255.0
access-group input allow_all
no shutdown
ip route 0.0.0.0 0.0.0.0 10.0.128.1
Regards,
Kanwal

Use Server Cert in Managed server not working

I am using WebLogic 10.3.3 for a managed server with a jks keystore and jrockit cacert as the Custom Identity and Java Standard Trust. I have the FQDN as the alias for the server in the keystore. Under Advanced, I have checked Use Server Cert so outgoing web service calls from my deployed application will use the server cert as its identifier. I have used this configuration before, but it is not working this time.
At first, there were some weird Unsupported OID messages when loading the cacerts, but I was able to clear those messages up. Now, when the managed server comes up, the keystore and cacert file load without error, but the outgoing calls do NOT have the certificate included.
I have no failures regarding the certificates in any of the output files. I have tried two separate keystore files without change. Any help would be appreciated.

You can re-create the SSL handshake with a command line java app that uses the same keystores. Is it possible that the service you're invoking is no longer requesting the client cert?
The command line uses a linux script and a java app:
--- linux script:
#!/bin/sh
CLIENT_KEYSTORE="full path to your server's identity keystore"
TRUST_STORE=$JAVA_HOME/jre/lib/security/cacerts
echo "Make sure you're using the right trust store..."
echo $TRUST_STORE
echo
echo "Enter trust store password"
read -s trustpass
echo
echo "Enter client keystore password for $CLIENT_KEYSTORE"
read -s keypass
SSL_OPTIONS="-Djavax.net.ssl.trustStore=$TRUST_STORE "
SSL_OPTIONS="$SSL_OPTIONS -Djavax.net.ssl.trustStorePassword=$trustpass "
SSL_OPTIONS="$SSL_OPTIONS -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true "
SSL_OPTIONS="$SSL_OPTIONS -Djavax.net.debug=ssl,handshake,verbose "
SSL_OPTIONS="$SSL_OPTIONS -Djavax.net.ssl.keyStore=$CLIENT_KEYSTORE "
SSL_OPTIONS="$SSL_OPTIONS -Djavax.net.ssl.keyStorePassword=$keypass "
javac SSL_Test.java
java -D $SSL_OPTIONS SSL_Test > client_ssl.out
---- java source:
import java.net.*;
import java.io.*;
public class SSL_Test {
public static void main(String[] args) throws Exception {
// https://someserver.net:999/someservice?wsdl
URL verisign = new URL( "address of the wsdl" );
System.out.println( "Opening URL: " + verisign.toString() ) ;
BufferedReader in = new BufferedReader(
new InputStreamReader(
verisign.openStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
to run this, just run the commEnv.sh script to set up your java and then run the script.
This has been very useful to me in the past in diagnosing ssl connectivity issues.

OBIEE 11g SSL Configuration Issue : Unable to import the Server certs

Hello All,
We are trying to configure OBIEE 11.1.1.6.0 with SSL using Windows server 2003 (IIS) and facing some issues with that.
Followed the document : OBIEE11g SSL Setup and Configuration [1326781.1]
http://obieedue.blogspot.sg/2012/08/obiee11g-ssl-setup-and-configuration.html
and also completed generating the required certificate signing request and keystores for SSL communication and sent it to the CA (IT Admin team) to to have the certificate signed by CA. The issue comes when I am trying to import the CA certificate (Root certificate) and Server Certificate into the Java Keystore.
I am importing the Root CA Certificate first which is successfully added to the keystore.
keytool -import -trustcacerts -alias mycacert -file cacert.pem -keystore mykeystore.jks -storepass Welcome1
Trust this certificate? [no]: yes
Certificate was added to keystore.
But when trying to add the Server Certificate to the keystore using the command below :
keytool -import -v -alias testserver -file server.cer -keystore mykeystore.jks -keypass Welcome1 -storepass Welcome1
Certificate reply was installed in keystore
I get the following error:
keytool error: java.lang.Exception: Failed to establish chain from reply
java.lang.Exception: Failed to establish chain from reply
at sun.security.tools.KeyTool.establishCertChain(KeyTool.java:2662)
at sun.security.tools.KeyTool.installReply(KeyTool.java:1870)
at sun.security.tools.KeyTool.doCommands(KeyTool.java:807)
at sun.security.tools.KeyTool.run(KeyTool.java:172)
at sun.security.tools.KeyTool.main(KeyTool.java:166)
Read many forums and tried to convert it to the PKCS#7 format and import the cert to the identity keystore, but was not successful in that either. I have also checked with the IT Admin team and found there is only one RootCA and no other intermediate CA's.
Please advice if any one has similar issues or suggestions.
Thanks in advance,
SVS

Hi,
One obvious reason would be that you did not specify -trustcacerts, and the root CA is not included in the present server keystore. In that case, using the -trustcacerts option would solve the problem, if the root CA is indeed in the JDK cacerts.
To print out the certificates present in the JDK cacerts, use the following command:
keytool -list -keystore <JAVA_HOME>/jre/lib/security/cacerts -storepass changeit -v
Then check if the root CA that signed your server certificate is present, and has not expired (in which case,you would need to re-import a newer one into cacerts).
Another common reason for that error message is when you have used a proprietary CA to sign your server certificate. Then it would obviously not be in the JDK cacerts. The solution in that case is to import your proprietary root CA into the JDK cacerts, using the following command:
keytool -import -keystore <JAVA_HOME>/jre/lib/security/cacerts -file yourRootCA.pem -storepass changeit -alias youralias
A third reason for that error message is when your server was signed by an intermediate certificate. In that case, you would have received from your CA a chain of certificates. One way to solve this (not the only one, but this one works well): Prepend your intermediate CA file to your server cert file, and import the obtained concatenated file into the server keystore. Be careful, the intermediate CA must be BEFORE the server cert. Example:
copy rootca.cer certchain.p7b
type server.cer >> certchain.p7b
The file certchain.p7b will be the concatenation of the intermediate CA and the signed server cert. Then import the newly created file under the key alias as follows:
keytool -import -keystore serverks.jks -file certchain.p7b -alias yourkey -trustcacerts
If you only prepend the intermediate root CA, you must make sure the the final root CA is in cacerts. But you can also prepend your whole chain of trust inside the server keystore.
Regards,
Kal

ACE issue with compression when SSL Initiation is turned on?

We currently doing an evaluation of the Cisco ACE 4710 and have some sites where the backend is Tomcat and SSL is turned on. When we set Default L7 Load-Balancing Action to Load Balance with Compression Method Deflate (I haven't tried gzip yet), requests to these sites return badly mangled stuff. Like a gif image at 7,700 bytes comes back as a 7 bytes file, even default should only try compression on text/*.
Has anyone seen a similar issue?

It turned out the problem was a configuration issue and my understanding of the ACE works with compression, policies, etc.
In conjunction with this I seemed to have found a bug in the GUI, which is also still present in A3 (2.3). I now have a default L7 policy which just set SSL Initiation to ssl client. Added another L7 policy but when looking at the virtual server afterwards the GUI doesn't show that policy.
switch/Development# show running-config policy-map FORD-APP.PERF.AUTC.COM-l7slb
Generating configuration....
policy-map type loadbalance first-match F-APP.PERF.AUTC.COM-l7slb
class default-compression-exclusion-mime-type
serverfarm F-APP.PERF.AUTC.COM
compress default-method deflate
insert-http rl_client_ip header-value "%is"
ssl-proxy client Backend
class class-default
serverfarm F-APP.PERF.AUTC.COM
insert-http rl_client_ip header-value "%is"
ssl-proxy client Backend
See attachment with screen shot of GUI

SSL initiation for SMPP on ACE module

Hi Community,
we have a new requirement to enable a connection to a server with SMPP protocol wrapped inside a SSL channel for transport over internet. Can any one suggest if the ACE module support to do SSL initiation to secure standard SMPP (3.4) servers?
Kind regards

Hi,
ACE does support SSL initiation. Please visit the below link for details. Ace also supports SSL termination and End-to-End SSL.
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/ssl/guide/initiate.html
Regards,
Kanwal

DPS Server SSL Certs Added to CA Certs Instead of Server Certs

When adding a replacement SSL cert to our Directory Proxy servers via either command line or DSCC, the server cert added is listed under "CA certs" (dpadm list-certs -C /var/dps), instead of "Certificates"/server certs (dpadm list-certs /var/dps) where it should appear.
I have read this similar thread:
SSL Cert Added to CA Certs Instead of Server Certs
...which doesn't appear to be resolved
I have displayed the cert and found the following details for this cert: (noting the question in response to the above mentioned thread)
X509v3 Basic Constraints: critical
CA:FALSE
Any ideas?
Gracias

What is odd is that this certificate worked fine on every other instance except this one. I will check the details of the certificate.

Two-Way SSL does not work until "Use Server Certs" is selected on client

We have a web service application and a client application. Both applications are deployed in WebLogic 10.3. The web service application is secured by Two-Way SSL. When the client attempts to access the service, we got the following error logs on the server side:
<Dec 8, 2009 3:25:42 PM EST> <Warning> <Security> <BEA-090508> <Certificate chain received from ... was incomplete.>
CertPathTrustManagerUtils.certificateCallback: certPathValStype = 0
CertPathTrustManagerUtils.certificateCallback: validateErr = 4
CertPathTrustManagerUtils.certificateCallback: returning false because of built-in SSL validation errors
We got the same error even if the WebLogic 10.3 domain on the client side uses the same identity and trust keystores as the server side.
The problem was solved when we selected Environment -> Servers -> <server> -> SSL, expanded "Advanced" and selected "Use Server Certs". Could anyone tell me what "Use Server Certs" does to make the difference?
Another question is how we can invoke this web service in a Java application since "Use Server Certs" solution only works for web application deployed in weblogic.

"Use Server Certs" means that a client application running within Weblogic will use the WL managed server's identity certificate as its client certificate. Otherwise, the client application is responsible for selecting the keystore, and presenting the certificate as part of the handshake.
This is a great feature in 9 & 10; client SSL was much more difficult in WL 8.
If you are using a standalone client application to invoke anything over 2-way SSL, you are responsible for presenting the certificate. For instance, if you invoke the page from your browser, your browser can maintain client certificates and you'll get a popup to select which cert to use.

Server name SSL does not match subject of certificate Server-Cert

Sun Java System Web Server 7.0U1 B06/12/2007 22:13
We see the following warning in the startup log everytime. We have been ignoring this for awhile now since SSL is working fine and browsers don't complain. But recently we found some mobile browsers are not happy with our SSL pages. So we are thinking this may be the casue.
warning ( 3256): CORE1251: On HTTP listener http-listener-2, server name SSL does not match subject "www.ourdomain.com" of certificate Server-Cert.
What does this warning really mean? Do we need to rename the server name "SSL" to match the domain name?
Thanks

AFAIK That warning is a result of the fact that the hostname doesn't match the certificate.
The cert has a Common Name (CN) attribute of the certificate's Subject Name or Subject Alternative Name (SAN) of type DNS name
should match with the server's DNS name.
hostname == machines name
I don't know if we need to change the instances server name as well.
I will try on my machine and and will let you know.
Are you sure this warning is the source of your problem? Look at what Joe has written :
"If most of your users are not getting browsers complaining of a mis-match then this is likely not the source of your mobile device problem."
Which mobile model and browsers are you getting complains from? We can try testing it here.

ACE SSL Proxy performance issue

Hi I've got an ACE module in a 6500 that is being used as an SSL Proxy For a web service.
So the configuration is fairly basic, matches a VIP which has been Nat'ed from the public IP address port 443 and load balances over a number of reservers with the server ports being set to 80.
The problem is the main web site is hosted elsewhere and so when they switch to checkout on a secure port the browser page requests multiple https:// files .
The users are seeing very slow page loads a considerable amount longer than equivalent on http and more than you'd expect. The ACE is no where near any throughout or transaction limits.
My concern is on how the session is tracked, would the ACE attempt to renegotiate with every https:// get? I've seen example configs for stickiness inserting cookies for normal end-end load balancing but not with an SSL proxy configuration.
Sent from Cisco Technical Support iPad App

Hi Craig,
The SSL negotiation/handshake will happen everytime a client opens a new TCP connection i.e comes with a different source port.
To make sure that ACE doesn't renegotiate you can try and use this command:
(config-parammap-ssl)# session-cache timeout . You can use 24 hours or anytime you think is suitable.
This is basically to enable SSL session reuse. A little explanation below for your reference:
When client connects to a server over SSL, the server creates a session for that connection. This session ID is sent as a part of the Server Hello message. This is to make things efficient, in case the client has any plans of closing the current connection and reconnect in the near future. Most of the servers have a time out for these sessions (I think 24 hours is a common value, unless pressed for space).
When the client connects to the same server again, it can send the same session ID as a part of the Client Hello. The server will first look up if it can find any sessions with that ID. If found, the same session will be reused. Thus the time spent in verifying the certs and negotiating the keys is saved. If the server cannot find a matching session, then it responds with a new session ID and its certificate in Server Hello message. The client knows that it has to verity the cert and negotiate the key again.
Considerable amount of time is spent in validating server certs. Reusing SSL session will save this time.
Having said that you need to check if the client is coming with a session ID which it got in previous handshake or not. If it doesn't and it is a new TCP connection then SSL handshake will happen. Please enable that command before testing.
Also, ensure that you have allocated proper SSL resources to your context. Lack of resources can also cause dropped connections and sluggish performance.
Regards,
Kanwal

JSSE Client and server communication problem .err:untrusted server cert

Hai all,
I am trying to communicate JSSE client and server.
I have created root.cert(CA),root.key,server.cert,server.key , client.cert and client.key. All these certificates are created using openssl.
I have placed root.cert in default keystore cacerts.
I have created a keystores(server & client) name mykeystore.
I have placed root.cert and client.cert in the client keystore.
I have placed root.cert and server.cert in the server keystore.
But during the run time i am getting javax.net.ssl.SSLException: untrusted server cert chain.
please suggest the modifications needs to be done to fix the error.
please tell me In the client keystore and in the server keystore....what certificates we need to put?
whether my approach as said above is correct or not?
In java code how to specify this particular certificate we are referring?
I have coded in this way ....
SSLContext ctx;
KeyManagerFactory kmf;
KeyStore ks;
char[] prasad = "prasad".toCharArray();
ctx = SSLContext.getInstance("SSLv3");
kmf = KeyManagerFactory.getInstance("SunX509");
ks = KeyStore.getInstance("jks");
ks.load(new FileInputStream("mykeystore"), prasad);
kmf.init(ks, prasad);
ctx.init(kmf.getKeyManagers(), null, null);
factory = ctx.getSocketFactory();
But my doubt is we are specifying only keystore name with that how it will check root.cert(ca) and client.cert and server.cert?
Is there any modifications need in my code?
Please tell me some way ...
Thanks ,
Prasad.

Hi prasad,
There will be a problem with the certificates being received from thr remote server or client. Check that your trust store contains the certificate of the remote machine or the CA that signed it and that the certificate has not expired.
Also be sure that both machines are using the latest version of the JSSE.
Hope this will help you.
Regards,
Anil.
Technical Support Engineer.

Untrusted server cert chain - MI 7.1 Client PDA

Dear Expert,
I am implementing SSL security in SAP MI 7.1.
The HTTPS service is already enabled (port 443) and I can enter on via browser.
Generate a certificate and signed by the SAP test certificate for 8 weeks.
Export the certificate to the truststore file, using the command:
keytool -import -file MID.cer -keystore truststore -alias MID -storepass access
Copy the truststore file (whit certificate MID) in PDA: \MI\settings.
And also enable the parameters (in configuration.properties ):
com.sap.tc.mobile.sync.http.port=443
com.sap.tc.mobile.sync.protocol=https
com.sap.tc.mobile.sync.http.sslenabled=true
com.sap.tc.mobile.sync.https.hostnameverifying=false
com.sap.tc.mobile.sync.https.truststore=/MI/settings/truststore
But in trying to synchronize the PDA with the DOE get an error: "untrusted server cert chain"
I am using: Client MI 7.1 for PDA SP9
I have reviewed the documents: "How To Configure SSL for SAP NetWeaver Mobile 7.1 Applicable"
Check various forms, without finding a solution ...
some idea of the problem?
Thanks!!

Hi,
Follow the below given links to configure SSL
--> Making External Server Certificates Trusted
http://help.sap.com/saphelp_dm40/helpdata/en/0f/8d80f68eace441b3d1ebdc4b
2f2c81/content.htm (The link applies for PDA also)
--> Configure the below given parameters in the default.properties
com.sap.tc.mobile.sync.http.sslenabled
> Default value: True
com.sap.tc.mobile.sync.https.hostnameverifying
> Default value: True
com.sap.tc.mobile.sync.https.truststore
> Location of truststore file containing SSL certificates. If the
given location is not absolute, the system searches for the file in a
path that is relative to the installation directory.
For more details refer Note : 1312866
And follow the below given link :
http://help.sap.com/saphelp_nwmobile71/helpdata/en/06/a7d001e17b421db7e2
dd8279853971/frameset.htm
--> Even after following the above mentioned steps,Do the following :
Create the Trustsore on a PC and then use a Addon to
deploy these files to the PDA along with the SSL Libraries.
Regards,
Suma

ACE SSL terminate not working ... please help

Hello, I configured cisco ace 4710 with ssl-proxy and it is not working, but http://10.1.40.2 and http://10.1.40.3 is OK. When i put https://10.1.41.20 the output is: "There is a problem with this website's security certificate", so i click in "Continue to this website (not recommended)" and the ace dont balance the output show error "Internet Explorer cannot display the webpage".
The configuration:
ace-demo/Admin# sh run
Generating configuration....
boot system image:c4710ace-mz.A3_2_4.bin
boot system image:c4710ace-mz.A3_2_1.bin
login timeout 0
hostname ace-demo
interface gigabitEthernet 1/1
channel-group 1
no shutdown
interface gigabitEthernet 1/2
channel-group 1
no shutdown
interface gigabitEthernet 1/3
channel-group 1
no shutdown
interface gigabitEthernet 1/4
channel-group 1
no shutdown
interface port-channel 1
switchport trunk allowed vlan 400-401,450
no shutdown
crypto csr-params testparams
country PE
state Lima
locality Lima
organization-name TI
organization-unit TI
common-name www.yyy.com
serial-number 1000
access-list anyone line 8 extended permit ip any any
access-list anyone line 16 extended permit icmp any any
parameter-map type ssl sslparams
cipher RSA_WITH_RC4_128_MD5
version SSL3
rserver host rsrv1
ip address 10.1.40.2
inservice
rserver host rsrv2
ip address 10.1.40.3
inservice
serverfarm host farm-demo
rserver rsrv1
    inservice
rserver rsrv2
    inservice
serverfarm host site-A
rserver rsrv1
    inservice
serverfarm host site-B
rserver rsrv2
    inservice
ssl-proxy service testssl
key testkey.key
cert testcert.pem
ssl advanced-options sslparams
class-map type management match-any MGMT
2 match protocol icmp any
3 match protocol http any
4 match protocol https any
5 match protocol snmp any
6 match protocol telnet any
7 match protocol ssh any
class-map match-any VIP
6 match virtual-address 10.1.41.10 any
class-map type generic match-any WAN-site-A
2 match source-address 192.168.10.106 255.255.255.255
3 match source-address 192.168.10.125 255.255.255.255
class-map type generic match-any WAN-site-B
2 match source-address 192.168.10.96 255.255.255.255
3 match source-address 192.168.10.93 255.255.255.255
class-map type management match-any icmp
2 match protocol icmp any
class-map match-any vip-ssl-10.1.41.20
2 match virtual-address 10.1.41.20 tcp eq https
policy-map type management first-match ICMP
class icmp
    permit
policy-map type management first-match MGMT
class MGMT
    permit
policy-map type loadbalance first-match vip-ssl-10.1.41.20
class class-default
    serverfarm farm-demo
policy-map type loadbalance generic first-match lb-server
class WAN-site-A
    serverfarm site-A
class WAN-site-B
    serverfarm site-B
class class-default
    serverfarm farm-demo
policy-map multi-match client-side
class VIP
    loadbalance vip inservice
    loadbalance policy lb-server
policy-map multi-match lb-vip
class vip-ssl-10.1.41.20
    loadbalance vip inservice
    loadbalance policy vip-ssl-10.1.41.20
    loadbalance vip icmp-reply
    ssl-proxy server testssl
interface vlan 400
description side-server
ip address 10.1.40.1 255.255.255.0
access-group input anyone
service-policy input ICMP
no shutdown
interface vlan 401
description side-client
ip address 10.1.41.1 255.255.255.0
access-group input anyone
access-group output anyone
service-policy input ICMP
service-policy input client-side
service-policy input lb-vip
no shutdown
interface vlan 450
description mgmt
ip address 10.1.45.1 255.255.255.0
access-group input anyone
service-policy input MGMT
no shutdown
ip route 192.168.10.0 255.255.255.0 10.1.45.10
And the proof:
ace-demo/Admin# sh serverfarm farm-demo
serverfarm     : farm-demo, type: HOST
total rservers : 2
                                                ----------connections-----------
       real                  weight state        current    total      failures
   ---+---------------------+------+------------+----------+----------+---------
   rserver: rsrv1
       10.1.40.2:0           8      OPERATIONAL 0          25         19
   rserver: rsrv2
       10.1.40.3:0           8      OPERATIONAL 0          23         18
ace-demo/Admin# sh crypto files
Filename                                 File File    Expor      Key/
                                         Size Type    table      Cert
admin                                    887   PEM     Yes         KEY
testcert.pem                             709   PEM     Yes        CERT
testkey.key                              497   PEM     Yes         KEY
ace-demo/Admin#
ace-demo/Admin# sh service-policy lb-vip class-map vip-ssl-10.1.41.20
Status     : ACTIVE
Interface: vlan 1 401
service-policy: lb-vip
    class: vip-ssl-10.1.41.20
      ssl-proxy server: testssl
      loadbalance:
        L7 loadbalance policy: vip-ssl-10.1.41.20
        VIP ICMP Reply       : ENABLED
        VIP State: INSERVICE
        Persistence Rebalance: DISABLED
        curr conns       : 0         , hit count        : 38
        dropped conns    : 18
        client pkt count : 159       , client byte count: 12576
        server pkt count : 16        , server byte count: 640
        conn-rate-limit      : 0         , drop-count : 0
        bandwidth-rate-limit : 0         , drop-count : 0
      compression:
        bytes_in : 0
        bytes_out : 0
        Compression ratio : 0.00%
in other time:
ace-demo/Admin# sh service-policy lb-vip class-map vip-ssl-10.1.41.20
Status     : ACTIVE
Interface: vlan 1 401
service-policy: lb-vip
    class: vip-ssl-10.1.41.20
      ssl-proxy server: testssl
      loadbalance:
        L7 loadbalance policy: vip-ssl-10.1.41.20
        VIP ICMP Reply       : ENABLED
        VIP State: INSERVICE
        Persistence Rebalance: DISABLED
        curr conns       : 0         , hit count        : 170
        dropped conns    : 89
        client pkt count : 703       , client byte count: 60089
        server pkt count : 85        , server byte count: 3400
        conn-rate-limit      : 0         , drop-count : 0
        bandwidth-rate-limit : 0         , drop-count : 0
      compression:
        bytes_in : 0
        bytes_out : 0
        Compression ratio : 0.00%
ace-demo/Admin#
ace-demo/Admin# sh stats crypto server
+----------------------------------------------+
+---- Crypto server termination statistics ----+
+----------------------------------------------+
SSLv3 negotiated protocol:                       43
TLSv1 negotiated protocol:                        0
SSLv3 full handshakes:                           37
SSLv3 resumed handshakes:                         0
SSLv3 rehandshakes:                               0
TLSv1 full handshakes:                            0
TLSv1 resumed handshakes:                         0
TLSv1 rehandshakes:                               0
SSLv3 handshake failures:                         6
SSLv3 failures during data phase:                 0
TLSv1 handshake failures:                         0
TLSv1 failures during data phase:                 0
Handshake Timeouts:                               0
total transactions:                               0
SSLv3 active connections:                         0
SSLv3 connections in handshake phase:             0
SSLv3 conns in renegotiation phase:               0
SSLv3 connections in data phase:                  0
TLSv1 active connections:                         0
TLSv1 connections in handshake phase:             0
TLSv1 conns in renegotiation phase:               0
TLSv1 connections in data phase:                  0
+----------------------------------------------+
+------- Crypto server alert statistics -------+
+----------------------------------------------+
SSL alert CLOSE_NOTIFY rcvd:                      0
SSL alert UNEXPECTED_MSG rcvd:                    0
SSL alert BAD_RECORD_MAC rcvd:                    0
SSL alert DECRYPTION_FAILED rcvd:                 0
SSL alert RECORD_OVERFLOW rcvd:                   0
SSL alert DECOMPRESSION_FAILED rcvd:              0
SSL alert HANDSHAKE_FAILED rcvd:                  0
SSL alert NO_CERTIFICATE rcvd:                    0
SSL alert BAD_CERTIFICATE rcvd:                   0
SSL alert UNSUPPORTED_CERTIFICATE rcvd:           0
SSL alert CERTIFICATE_REVOKED rcvd:               0
SSL alert CERTIFICATE_EXPIRED rcvd:               0
SSL alert CERTIFICATE_UNKNOWN rcvd:               6
SSL alert ILLEGAL_PARAMETER rcvd:                 0
SSL alert UNKNOWN_CA rcvd:                        0
SSL alert ACCESS_DENIED rcvd:                     0
SSL alert DECODE_ERROR rcvd:                      0
SSL alert DECRYPT_ERROR rcvd:                     0
SSL alert EXPORT_RESTRICTION rcvd:                0
SSL alert PROTOCOL_VERSION rcvd:                  0
SSL alert INSUFFICIENT_SECURITY rcvd:             0
SSL alert INTERNAL_ERROR rcvd:                    0
SSL alert USER_CANCELED rcvd:                     0
SSL alert NO_RENEGOTIATION rcvd:                  0
SSL alert CLOSE_NOTIFY sent:                      0
SSL alert UNEXPECTED_MSG sent:                    0
SSL alert BAD_RECORD_MAC sent:                    0
SSL alert DECRYPTION_FAILED sent:                 0
SSL alert RECORD_OVERFLOW sent:                   0
SSL alert DECOMPRESSION_FAILED sent:              0
SSL alert HANDSHAKE_FAILED sent:                  0
SSL alert NO_CERTIFICATE sent:                    0
SSL alert BAD_CERTIFICATE sent:                   0
SSL alert UNSUPPORTED_CERTIFICATE sent:           0
SSL alert CERTIFICATE_REVOKED sent:               0
SSL alert CERTIFICATE_EXPIRED sent:               0
SSL alert CERTIFICATE_UNKNOWN sent:               0
SSL alert ILLEGAL_PARAMETER sent:                 0
SSL alert UNKNOWN_CA sent:                        0
SSL alert ACCESS_DENIED sent:                     0
SSL alert DECODE_ERROR sent:                      0
SSL alert DECRYPT_ERROR sent:                     0
SSL alert EXPORT_RESTRICTION sent:                0
SSL alert PROTOCOL_VERSION sent:                 47
SSL alert INSUFFICIENT_SECURITY sent:             0
SSL alert INTERNAL_ERROR sent:                    0
SSL alert USER_CANCELED sent:                     0
SSL alert NO_RENEGOTIATION sent:                  0
+-----------------------------------------------+
+--- Crypto server authentication statistics ---+
+-----------------------------------------------+
Total SSL client authentications:                 0
Failed SSL client authentications:                0
SSL client authentication cache hits:             0
SSL static CRL lookups:                           0
SSL best effort CRL lookups:                      0
SSL CRL lookup cache hits:                        0
SSL revoked certificates:                         0
Total SSL server authentications:                 0
Failed SSL server authentications:                0
+-----------------------------------------------+
+------- Crypto server cipher statistics -------+
+-----------------------------------------------+
Cipher sslv3_rsa_rc4_128_md5:                    43
Cipher sslv3_rsa_rc4_128_sha:                     0
Cipher sslv3_rsa_des_cbc_sha:                     0
Cipher sslv3_rsa_3des_ede_cbc_sha:                0
Cipher sslv3_rsa_exp_rc4_40_md5:                  0
Cipher sslv3_rsa_exp_des40_cbc_sha:               0
Cipher sslv3_rsa_exp1024_rc4_56_md5:              0
Cipher sslv3_rsa_exp1024_des_cbc_sha:             0
Cipher sslv3_rsa_exp1024_rc4_56_sha:              0
Cipher sslv3_rsa_aes_128_cbc_sha:                 0
Cipher sslv3_rsa_aes_256_cbc_sha:                 0
Cipher tlsv1_rsa_rc4_128_md5:                     0
Cipher tlsv1_rsa_rc4_128_sha:                     0
Cipher tlsv1_rsa_des_cbc_sha:                     0
Cipher tlsv1_rsa_3des_ede_cbc_sha:                0
Cipher tlsv1_rsa_exp_rc4_40_md5:                  0
Cipher tlsv1_rsa_exp_des40_cbc_sha:               0
Cipher tlsv1_rsa_exp1024_rc4_56_md5:              0
Cipher tlsv1_rsa_exp1024_des_cbc_sha:             0
Cipher tlsv1_rsa_exp1024_rc4_56_sha:              0
Cipher tlsv1_rsa_aes_128_cbc_sha:                 0
Cipher tlsv1_rsa_aes_256_cbc_sha:                 0
ace-demo/Admin# crypto verify testkey.key testcert.pem
Keypair in testkey.key matches certificate in testcert.pem.
ace-demo/Admin#
ace-demo/Admin# sh conn
total current connections : 0
conn-id    np dir proto vlan source                destination           state
----------+--+---+-----+----+---------------------+---------------------+------+

Hello Alvaro,
The issue here is that your config is missing the clear text port the ACE should use to send the traffic to the backend servers; in this case port 80.
Remove the rservers from the SF "farm-demo" and then configure them back like this:
serverfarm host farm-demo
rserver rsrv1 80
    inservice
rserver rsrv2 80
    inservice
That should do the trick =)
HTH
Pablo

ACE - SSL Termination is not working

HTTPS is not working from official IE browser but it is working from test Firefox browser. However HTTP is working with both IE and Firefox browsers. This is true for multiple implementations on the ACE service module with SSL termination.
ACE software 3.0(0)A1(4a)
IE v6 SP3 Cipher 128
Firefox v3.6.3
Sample configuration:
access-list FT ethertype permit bpdu
access-list ALL-ACCESS extended permit icmp any any
access-list ALL-ACCESS extended permit ip any any
crypto chaingroup ROOT-CERT
cert abc.PEM
cert xyz.PEM
parameter-map type ssl SSL-PARAMETER-1
cipher RSA_WITH_RC4_128_MD5
cipher RSA_WITH_RC4_128_SHA
cipher RSA_WITH_AES_128_CBC_SHA priority 2
cipher RSA_WITH_AES_256_CBC_SHA
cipher RSA_EXPORT1024_WITH_DES_CBC_SHA
parameter-map type ssl SSL-PARAMETER-2
cipher RSA_WITH_AES_128_CBC_SHA priority 2
ssl-proxy service SSL-1
key KEY-1.PEM
cert CERT-1.PEM
chaingroup ROOT-CERT
ssl advanced-options SSL-PARAMETER-1
ssl-proxy service SSL-2
key KEY-1.PEM
cert CERT-1.PEM
chaingroup ROOT-CERT
ssl advanced-options SSL-PARAMETER-2
ssl-proxy service SSL-3
key KEY-1.PEM
cert CERT-1.PEM
chaingroup ROOT-CERT
rserver host server1
ip address 10.100.15.89
inservice
rserver host server2
ip address 10.100.15.121
inservice
probe http PROBE-1
interval 30
faildetect 2
request method get url /keepalive.htm
expect status 200 200
serverfarm host SERVERFARM-1
probe PROBE-1
rserver server1 80
    inservice
rserver server2 80
    inservice
sticky ip-netmask 255.255.255.255 address both STICKY-1
timeout 30
replicate sticky
serverfarm SERVERFARM-1
class-map type management match-any REMOTE-ACCESS
match protocol icmp any
match protocol snmp any
match protocol ssh any
match protocol https any
class-map match-all VIP-1
match virtual-address 10.100.15.140 tcp eq https
class-map match-all VIP-2
match virtual-address 10.100.15.140 tcp eq www
policy-map type management first-match REMOTE-ACCESS
class REMOTE-ACCESS
    permit
policy-map type loadbalance first-match POLICY-1
class class-default
    sticky-serverfarm STICKY-1
policy-map multi-match LB-1
class VIP-1
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    loadbalance policy POLICY-1
    ssl-proxy server SSL-1
(i have tried with ssl-proxy server SSL-2 and ssl-proxy server SSL-3 but did not helP)
policy-map multi-match LB-2
class VIP-2
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    loadbalance policy POLICY-1
interface vlan 15
description client vlan
bridge-group 15
mac-sticky enable
access-group input FT
access-group input ALL-ACCESS
access-group output ALL-ACCESS
service-policy input REMOTE-ACCESS
service-policy input LB-1
service-policy input LB-2
no shutdown
interface vlan 2015
description server vlan
bridge-group 15
mac-sticky enable
access-group input FT
access-group input ALL-ACCESS
access-group output ALL-ACCESS
service-policy input REMOTE-ACCESS
no shutdown
interface bvi 15
description bridge group
ip address 10.100.15.5 255.255.255.0
peer ip address 10.100.15.6 255.255.255.0
alias 10.100.15.4 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 10.100.15.1
note: Subnet, Server Name, Certificate Name and Key Name are modified for security reason.

Hello,
We will not be able to determine why your SSL terminated connections fail with only your config. You may want to take a look at a similar thread where someone else was having problems with IE and SSL termination, but Firefox worked fine. It also includes a solid action plan you can use to gather data needed to diagnose root cause. That thread can be viewed at the following link:
https://supportforums.cisco.com/thread/2025417?tstart=0
Also, the ACE software you are running is extremely old now and very buggy. I would strongly urge you to upgrade to A2(2.4) as soon as possible. It will help you avoid some headaches as you move forward.
Hope this helps,
Sean

ACE SSL Initiation - no check of server cert?

Similar Messages

Maybe you are looking for