F5 (C3D) Client Certificate Constrained Delegation

These are the essential building blocks that make F5 C3D work for secure mTLS inspection and certificate delegation:

• C3D Client SSL Profile: Authenticates incoming client certificates and manages the initial TLS handshake from the client side. It ensures only trusted clients are allowed through by validating their certificates.
• C3D Server SSL Profile: Generates and presents a temporary (forged) client certificate to the backend server. This enables the F5 to create a secure mTLS session with the backend, maintaining end-to-end encryption.
• Trusted CA Bundle: A set of certificate authorities (CAs) that the F5 uses to validate client certificates. Only certificates from these trusted CAs will be accepted.
• OCSP Responder (Optional): Provides real-time certificate revocation checking. F5 can use this to ensure client certificates are still valid and haven’t been revoked.

Before you implement F5 Client Certificate Constrained Delegation (C3D), make sure you have the following prerequisites in place:

• F5 BIG-IP Version:
  C3D is supported on BIG-IP 13.0 and above, & for the latest features and easier integration, version 17.1.0+ is recommended.
• Valid Server Certificate and Key:
  You need a public-facing server certificate & private key for the Client SSL profile, which will be presented to clients connecting to the F5.
• Trusted CA Bundle:
  A bundle of certificate authorities (CAs) that the F5 will use to validate incoming client certificates. This ensures only trusted client certificates are accepted.
• OCSP Responder (Optional but Recommended):
  For real-time client certificate revocation checking, configure an OCSP responder. This helps verify that client certificates haven’t been revoked.
• Backend Server Trust:
  The backend server must trust the CA that the F5 uses to sign the forged client certificates. This is essential for successful mTLS authentication.
• Network and Access:
  Ensure network connectivity between the F5, backend servers, and OCSP responder.

Complete guide including CA creation, SSL profiles, and trust configuration.

• Step 1: Generate Dedicated C3D CA Hierarchy
  Create Root and Intermediate CAs using OpenSSL

  # Generate Root CA (4096-bit RSA, 10-year validity)
  openssl genrsa -out C3D_Root_CA.key 4096
  openssl req -x509 -new -nodes -key C3D_Root_CA.key -sha384 -days 3650 \
    -subj "/CN=F5-C3D-Root-CA/O=Security/OU=C3D" -out C3D_Root_CA.crt
  
  # Generate Intermediate CA (for forged certificates)
  openssl genrsa -out C3D_Intermediate_CA.key 4096
  openssl req -new -key C3D_Intermediate_CA.key \
    -subj "/CN=F5-C3D-Intermediate-CA/O=Security/OU=C3D" \
    -out C3D_Intermediate_CA.csr
  openssl x509 -req -in C3D_Intermediate_CA.csr -CA C3D_Root_CA.crt \
    -CAkey C3D_Root_CA.key -CAcreateserial -sha384 -days 1825 \
    -out C3D_Intermediate_CA.crt
      

• Step 2: Client SSL Profile (F5 GUI)
  Path: Local Traffic > Profiles > SSL > Client > Create
  Basic Settings:

  • Name: c3d_client_profile
  • Parent Profile: /Common/clientssl
  • Certificate: Public-facing cert (e.g., app.acme.com.crt)
  • Key: app.acme.com.key

  Client Authentication:

  • Client Certificate: Require
  • Trusted CAs: Upload C3D_Root_CA.crt
  • Frequency: Once (or Always for strict)
  • Advertised Certificate Authorities: C3D_Root_CA.crt

  C3D Settings:

  • Certificate Constrained Delegation: Enabled
  • Signing CA Bundle: C3D_Intermediate_CA.crt
• Step 3: Server SSL Profile (F5 GUI)
  Path: Local Traffic > Profiles > SSL > Server > Create
  Basic Settings:

  • Name: c3d_server_profile
  • Parent Profile: /Common/serverssl
  • Certificate: C3D_Intermediate_CA.crt
  • Key: C3D_Intermediate_CA.key

  C3D Settings:

  • Certificate Constrained Delegation: Enabled
  • CA Certificate: C3D_Root_CA.crt
  • CA Key: C3D_Root_CA.key
  • Certificate Lifetime: 3600 (1 hour)

  Key Relationships:

  Field	Value	Purpose
  Certificate/Key	Intermediate CA	Signs forged client certificates
  CA Certificate/Key	Root CA	Root of trust chain

• Step 4: Backend Server Trust Configuration
  Servers must trust the C3D Intermediate CA
  Linux (Update CA Trust):

  sudo cp C3D_Intermediate_CA.crt /usr/local/share/ca-certificates/
  sudo update-ca-certificates
  systemctl restart nginx/apache
        

  Windows (Cert Manager):

  1. Run certlm.msc
  2. Import C3D_Intermediate_CA.crt to Trusted Root Certification Authorities

# Check forged certificate details
openssl s_client -connect app.acme.com:443 -servername app.acme.com \
  -showcerts 2>/dev/null | openssl x509 -noout -issuer -subject

# Expected output:
Issuer: CN=F5-C3D-Intermediate-CA
Subject: CN=original.client.com (forged)

After configuring C3D, use these methods to validate end-to-end functionality from client to backend server.

• Client-Side Validation
  Verify client certificate presentation and forged cert generation

  # Basic connection test
  openssl s_client -connect app.acme.com:443 -servername app.acme.com \
    -cert client.pem -key client.key -CAfile Public_CA.crt -state -debug
  
  # Expected output:
  Verify return code: 0 (ok)
  subject=CN = original.client.com
  issuer=CN = F5-C3D-Intermediate-CA
      

  Key checks:
  • "Client Certificate" appears in debug output
  • Final certificate issuer matches C3D Intermediate CA
  • Return code 0 (success)
• F5-Side Validation
  Confirm decryption and certificate forging

  # Capture decrypted traffic (F5 CLI)
  tcpdump -ni 0.0:nnnp -s0 -vvv 'port 443' -w /var/tmp/c3d_capture.pcap
  
  # Check forged certificates
  tmsh show ltm c3d sessions detail | grep -E 'Client|Issuer'
  
  # Expected output:
  Client: CN=original.client.com
  Issuer: CN=F5-C3D-Intermediate-CA
      

  Wireshark analysis:
  • Client Hello shows original client cert
  • Server Hello shows forged cert from C3D CA
  • Decrypted HTTP headers visible in F5→backend traffic
• Server-Side Validation
  Verify backend receives valid forged certificates
  NGINX/Apache logs:

  tail -f /var/log/nginx/ssl.log
  # Expected entry:
  SSL_CLIENT_S_DN: CN=original.client.com (Issuer: CN=F5-C3D-Intermediate-CA)
        

  Windows Event Viewer:

  Event ID 36886 (Schannel):
  A TLS client certificate was received and validated.
  Subject: CN=original.client.com
  Issuer: CN=F5-C3D-Intermediate-CA
        

• OCSP Validation (If Configured)
  

  # Verify OCSP response
  openssl ocsp -issuer C3D_Intermediate_CA.crt -cert client.pem \
    -url http://ocsp.acme.com -resp_text
  
  # Expected output:
  Cert Status: good
  This Update: Jun 16 12:20:00 2025 GMT
      

Diagnose and resolve common issues in C3D implementations using this structured approach.

• Connection Flow with SNAT
  Understand each step to isolate failures

  1. Client Initiation:
     - Client → F5 VIP:443 (ClientHello with original cert)
     
  2. F5 Processing:
     - Validates client cert against Trusted CA
     - Decrypts traffic for inspection
     - Applies SNAT (e.g., 192.168.1.100)
     - Generates forged cert using Server SSL Profile CA
     
  3. Backend Communication:
     - F5 (SNAT IP) → Backend:443 (ClientHello with forged cert)
     - Server validates forged cert against C3D CA
     
  4. Response Handling:
     - Backend → F5 (encrypted with forged cert)
     - F5 re-encrypts with original client cert
     - Client receives response via original TLS session
      

• Troubleshooting Methodology
  Layer-by-layer diagnostics
  1. Client-Side Checks:

  # Verify certificate chain
  openssl verify -CAfile Public_CA.crt client.pem
  
  # Test bypassing F5 (direct to backend)
  openssl s_client -connect backend.acme.com:443 -cert client.pem -key client.key
        

  2. F5-Side Checks:

  # Check C3D session status
  tmsh show ltm c3d sessions
  
  # Verify SSL profiles
  tmsh list ltm profile client-ssl c3d_client_profile
  tmsh list ltm profile server-ssl c3d_server_profile
  
  # SNAT verification
  tmsh show ltm snat-translations | grep -B 4 "Virtual Server"
        

  3. Backend-Side Checks:

  # Verify CA trust store
  openssl verify -CAfile /etc/ssl/certs/C3D_Intermediate_CA.crt forged_cert.pem
  
  # Check firewall rules
  ss -tulpn | grep 443
        

  4. Full Transaction Capture:

  # Simultaneous captures
  tcpdump -ni 1.1 'host 203.0.113.10' -w /var/tmp/client-side.pcap &
  tcpdump -ni 1.2:nnnp 'net 192.168.1.0/24' -w /var/tmp/backend-side.pcap & 
  
  # Replace VIP_IP and BACKEND_IPs with actual values
  tcpdump -nni 0.0:nnnp -s0 '(host VIP_IP and port 443) or (host BACKEND_IP1 or host BACKEND_IP2)' -w /var/tmp/targeted_capture.pcap
        

• Common Errors & Solutions
  

  Symptom	Possible Cause	Solution
  "Peer certificate cannot be authenticated"	Backend doesn't trust C3D CA	Reimport C3D_Intermediate_CA.crt to server trust store
  No SNAT translation occurring	Missing SNAT pool in Virtual Server	Attach SNAT pool to virtual server configuration
  OCSP response "trylater"	OCSP responder overloaded	Implement OCSP stapling or caching
  SSL Handshake fails after SNAT	Backend ACL blocking SNAT IP	Add firewall rule for SNAT pool IP range
  Certificate "issuer missing" error	Incomplete CA chain in Server SSL Profile	Include full chain (Root → Intermediate) in profile
  Intermittent connection resets	Forged certificate lifetime too short	Increase Certificate Lifetime in Server SSL Profile

• Advanced Diagnostics
  Use these commands for deep inspection

  # Verify forged certificate details
  tmsh show ltm c3d certificates | grep -A 4 "Subject DN"
  
  # Check TLS version mismatch
  tcpdump -nnvr capture.pcap 'tls.handshake.version == 0x0303' | wc -l
  
  # Test SNAT path independently
  curl -vk https://backend.acme.com --local-addr 192.168.1.100
  
  # Monitor real-time connections
  watch -n 1 "tmsh show ltm connection cs-server-addr 192.168.1.20"
      

Start
│
├─ Client connection fails
│   ├─ OpenSSL handshake error? → Verify Client SSL Profile
│   │   ├─ Check Trusted CA Bundle matches client cert issuer [1][3]
│   │   └─ Confirm C3D enabled in Client SSL Profile [3]
│   │
│   └─ No forged cert generated? → Check Server SSL Profile
│       ├─ Verify CA Certificate/Key in Server Profile [3][5]
│       └─ Confirm Certificate Lifetime > 0 [5]
│
├─ Backend rejects connection
│   ├─ Server trust issue? → Validate C3D CA in backend trust store [2]
│   │
│   └─ TLS version mismatch? → Check Server Profile ciphers [4]
│       ├─ Compare with backend's accepted protocols
│       └─ Use openssl s_client -cipher to test
│
└─ Intermittent failures
    ├─ OCSP/CRL issues? → Test responder connectivity [3]
    │   ├─ openssl ocsp command verification
    │   └─ Check firewall rules for OCSP port (TCP/2560)
    │
    └─ SNAT problems? → Verify pool configuration
        ├─ tmsh show ltm snat-translations
        └─ Confirm return route for SNAT IP exists