Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
My backend uses a self-signed certificate; is that a problem?
Short answer
There is no problem with the default settings. While SSL Service is on in the Backend Service, Certificate Verification is None by default: TR7 encrypts the connection but does not verify the certificate of the server, so a self-signed or expired certificate, or one that belongs to another name, is also accepted. If the identity of the server is also to be verified, the self-signed certificate (or the internal CA that signs it) is added to the Certificates & PKI → Certificate Authorities (CA) screen, and in the Backend Service, with Certificate Verification = Required, this record is selected in the Verification CA Profile field; for the name to be checked as well, the SNI field is filled in (the SNI field is applied only on the HTTP vService).
Two Options
| Certificate Verification = None (default) | Certificate Verification = Required | |
|---|---|---|
| Encryption | Yes | Yes |
| Identity of the server | Not verified | The certificate must chain to the selected CA record; if SNI is filled in, the name is also checked |
| Self-signed certificate | Accepted | Accepted if the certificate itself is added and selected as a CA record |
| Expired certificate | Accepted | Rejected; TR7 cannot connect to the server |
| Suitable situation | TR7 and the servers are in the same trusted network | Shared or untrusted network, regulatory requirement |
Enabling Verification
1
Adım 1 Open the CA add form
On the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked (how to add).
2
Adım 2 Define the certificate as a CA record
CA Name is entered; in the Operation field, the default Add a trusted CA certificate is left as it is, and the self-signed certificate of the server (if the servers are signed by an internal CA, the certificate of that CA) is pasted into the CA Certificate (PEM) field.
3
Adım 3 Save the CA record
Add is clicked.
4
Adım 4 Open the Backend Service edit form
On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked; SSL Service must be on.
5
Adım 5 Turn on verification
Certificate Verification = Required is selected; in the Verification CA Profile field that appears, the record from step 3 is selected. If no CA record is selected, verification is not performed even though Required is selected.
6
Adım 6 Specify the name
For the name in the certificate to be checked as well, the name in the CN or SAN value of the certificate is written in the SNI field (e.g. app01.example.local). If SNI is left empty, only the chain is verified and the name is not checked. The SNI field is applied only on the HTTP vService; on the L7 TCP vService, even if the field is filled in, SNI is not sent to the server and the name is not checked.
7
Adım 7 Save
Edit at the bottom of the form is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.
If verification fails, TR7 cannot establish a connection with the server; the health status in the Backend Services list and the vService traffic are checked. Details: Can I verify the backend certificate when connecting to the backend over HTTPS?
Common Misconceptions
- "While SSL Service is on, TR7 also verifies the identity of the server." By default, it only encrypts; for identity verification, Certificate Verification = Required is selected.
- "Selecting Required is enough." If Verification CA Profile is not selected, verification is not performed.
- "When the self-signed certificate expires, the connection drops." In None mode, an expired certificate is also accepted; in Required mode, it is rejected. If Required is used, the expiry of the server certificates is monitored.
- "The SSL Security settings in the Backend Service change this behavior." Backend SSL Security Profile determines only the version, the cipher and the curve; certificate verification is in the Certificate Verification field.
How it is done in the documentation
