3.5. Create SSL Configurations

On the SSL Configurations page, create the Client-side SSL profile for the L3 Outbound forward proxy.

1. In the Name field, leave the default value as l3_outbound.

2. Enter a description for the SSL configuration.

3. Leave the SNI Server Name (FQDN) field empty and do not select the Default SNI checkbox. These settings are not applicable to the current scenario.

Client-side SSL Settings

1. In the Client-side SSL > Certificate Key Chain section, leave the default settings as is (default certificate and key).

   Important

   Since this is an outbound forward proxy deployment, the SSL Orchestrator will be using a subordinate (intermediate) CA certificate and private key to sign the re-issued (forged) certificates delivered to clients. This is configured in the CA Certificate Key Chains section, not the Certificate Key Chains section.

   
   

2. In the CA Certificate Key Chain section, click on the Edit (pencil) icon.

   
   
   

3. In the Certificate drop-down list, select subrsa.f5labs.com to replace the default value.

4. In the Key drop-down list, select subrsa.f5labs.com to replace the default value.

5. Ensure that the Passphrase field is empty (clear it if not empty).

6. Click the Done button to continue.

   
   
   
   
   
   

Note

When using subordinate (intermediate) CA certificates, both the subordinate and root CA certificates must be imported into the client browser's trusted certificates store. The Ubuntu-Client machine in the lab environment already has these installed.

Server-side SSL Settings

These settings define the ciphers that SSL Orchestrator can use when initiating TLS connections to remote servers, as well as the Certificate Authorities that are trusted.

1. The default Server-side SSL settings are sufficient for outbound Internet forward proxy use-cases.

   
   
   

2. Click on the Save & Next button to proceed to the next step in the configuration workflow.