Alteon Application Switch Operating System Application Guide
Offloading SSL Encryption and Authentication
Document ID: RDWR-ALOS-V2900_AG1302
343
Client Authentication Policies
SSL client authentication enables a server to confirm a client's identity as part of the SSL handshake
process. A client's certificate and public ID are checked to be valid and that they were issued by a
trusted Certificate Authority (CA). If the certificate is valid, the handshake process is completed,
allowing data to be sent to the intended destination. If the certificate is not valid, the session is
terminated.
When using SSL offloading, you can optionally define a client authentication policy that
authenticates the client’s identity. You associate a client authentication policy to an SSL policy, and
the SSL policy, in turn, is associated to a virtual service.
To authenticate the client's identity, you import a CA certificate into Alteon. This CA certificate is
used when Alteon receives a client certificate to validate it. By checking that it was generated by this
trusted CA. Additionally, you can configure Alteon to ensure that the client certificates were not
revoked by checking their statuses using OCSP (Online Certificate Status Protocol).
Following an SSL handshake where client authentication was performed successfully (for example
the client provided a valid certificate that identifies it and was issued by the trusted CA), you may
want to validate the certificate was not revoked since it was generated. Alteon enables you to
perform ad hoc certificate validation using Online Certificate Status Protocol (OCSP).
Note:
Certificate validation is using the SSL handshake process, which means the TCP handshake
was already completed. This implies that Alteon will open the connection to the back-end server
even if the OCSP validation failed.
For details on configuring client authentication policies, see the section on the
/cfg/slb/ssl/
authpo
l menu in the Alteon Application Switch Operating System Command Reference.
To offload OCSP servers from frequent, repetitive validation requests, Alteon saves OCSP responses
in a cache for a defined period of time. In some cases you may want to purge the OCSP cache of
OCSP responses. For more details, see the section on the
/oper/slb/ocsppurg
command in the
Alteon Application Switch Operating System Command Reference.
Common SSL Offloading Service Use Cases
The following are examples of common use cases for configuring an SSL offloading service:
•
Example 1: Configuring a Basic SSL Offloading Service, page 343
•
Example 2: Configuring a Basic SSL Offloading Service for a Non-HTTP Protocol, page 345
•
Example 3: Configuring an SSL Offloading Service with Back-End Encryption, page 347
•
•
Example 5: Configuring an SSL Offloading Service with Client Authentication, page 352
Example
1: Configuring a Basic SSL Offloading Service
1. Before you can configure an SSL offloading service, ensure that Alteon is configured for basic
SLB:
—
Assign an IP address to each of the real servers in the server pool.
—
Define an IP interface.
—
Define each real server.
