The earlier version did not support client certificates that use SHA2 Signing Hash Algorithms.Ĭonfigure the F5 as a vanilla load balancer A recent customer problem was solved when they upgraded their F5 from version 10.2.4 to 11.5.4. Don’t rely on this post to create a secure system.įor the tests this post is based on, we used an F5 running software version 11.5.1. Your F5 configuration should always be reviewed and tested by your networking and Information Security departments. This post is designed to help an F5 expert configure Mutual TLS. The F5 acts as a client to its servers.į5 systems are complex. The F5’s “servers” are the pools of servers that will ultimately handle the incoming requests. In the offloading configuration, the F5 “clients” are the clients on the Internet. Offloading configurations are more common and this post focuses on that configuration. An F5 can also be configured to “pass-through” the HTTPS conversation to the back-end servers. The F5 passes the requests onwards to the servers in the pool, balancing the requests amongst the servers.įor HTTPS requests, the F5 can act as the terminus for the SSL/TLS session, offloading the SSL/TLS cryptography work from the servers. Clients (web browsers and computers such as the DocuSign Connect system) make requests via the Internet to the F5. Typically, F5 Big-IP load balancers are placed between the Internet and a pool of one or more servers. My thanks to George Balafoutis, DocuSign Director of Technical Architecture, for his F5 expertise and help in preparing this post. In this post, I’ll cover the configuration of an F5 Load Balancer for Mutual TLS and access control. Either Mutual TLS or the notification payload’s digital signature can be used. In a previous post, Mutual TLS: Stuff you should know, I discussed Mutual TLS and how it enables your Connect (or eventNotification) listener to authenticate the HTTPS client (the DocuSign platform).Ĭonnect webhook listeners should always authenticate the client and use access control to ensure that the client is DocuSign.

F5 load balancer algorithm