I have an F5 load balancer and a backend server. Load balancer is www.example.com. Backend server is server1.example.com. I have the F5 load balancer with SSL Profile (client)
and SSL Profile (server)
enabled and SSL certs on the load balancer and backend server. So it looks like this:
Client (laptop) --> HTTPS/SSL --> F5 Load Balancer (www.example.com) --> HTTPS/SSL --> Backend server (server1.example.com)
The backend server is running Windows 2012/IIS 8.5. In the bindings, the Host Name field is blank.
I expected a request to www.example.com to fail because the backend server SSL Cert is for server1.example.com. It actually succeeds. I don't understand why it works.
If I set the Host Name in the IIS bindings to server1.example.com, the request does fail. If i leave it blank or set it to www.example.com, the request succeeds. Not sure why. Doesn't make sense.
I understand the F5 LB is acting as the client in the handshake between itself and the backend server. But my understanding is the F5 is sending a request for www.example.com (host name) to the backend server. The backend SSL cert is for server1.example.com. Therefore, the request should fail because the host name being sent by the F5 does not match the host name associated with the backend server SSL cert. That is, www.example.com != server1.example.com.
Please tell me where I am wrong in my logic because I obviously am. I just don't understand why it works.
Thank you.
openssl x509 -in <cert> -text
(and modify the output to not show private data, but I guess that the most important part should beSubject:
andX509v3 Subject Alternative Name:
). If the server is capable of accepting a challenge forwww.example.com
its cert must have that as the main or alternative name.