Can I verify the backend certificate when connecting to the backend over HTTPS?

Short answer

Yes. On the Backend Service, while SSL Service is on, Certificate Verification = Required is selected, and the CA that signed the server's certificate is selected in the Verification CA Profile field; the CA is first added on the Certificates & PKI → Certificate Authorities (CA) screen. If no CA record is selected, no verification is performed even though Required is selected. For the name in the certificate to be checked as well, the SNI field is filled in (applied only on an HTTP vService); if SNI is empty, only the chain is verified. The default is None: TR7 encrypts the traffic but does not verify the server's identity. In a Backend Group, the same fields are found at the group level.

Problem: TR7 Does Not Know That the Server It Connects to Is Genuine

In a TLS connection established without verification, the traffic is encrypted, but TR7 does not check that the server on the other side is really the expected server; a device placed in between can take over the connection with its own certificate. On shared or untrusted network segments, on cloud connections, or when regulations require it, the server's certificate needs to be verified.

Solution: Two Methods

Your situation	Suitable method
From the UI (a single Backend Service or a Backend Group)	Method 1: Certificate Verification = Required
From the command line	Method 2: WEB-CLI

Method 1: Certificate Verification = Required Recommended

• How it works TR7 checks that the certificate presented by the server chains to the selected CA record, that it is within its validity period and, if SNI is filled in, that the name in the certificate matches the SNI value; if verification fails, the connection is not established. The health check of the Backend Service also verifies with the same CA if it has no CA selection of its own.
• Where it is openedLoad Balancer → Backend Services → Edit → SSL Service → Certificate Verification / Verification CA Profile
• Requirement The certificate of the CA that signed the server's certificate; a port on the server that listens with TLS
• vService type HTTP, L7 TCP (name check with SNI on an HTTP vService)

Step-by-Step Configuration

1

Adım 1 Open the CA add form

On the Certificates & PKI → Certificate Authorities (CA) screen, Add is clicked (how to add). If the CA is already registered, steps 1–3 are skipped.

2

Adım 2 Define the CA

CA Name is entered; in the Operation field, the default Add a trusted CA certificate is left as is, and the certificate of the CA that signed the server certificate is pasted into the CA Certificate (PEM) field (How do I add my own internal CA to TR7?).

3

Adım 3 Save the CA record

Add is clicked.

4

Adım 4 Open the Backend Service edit form

On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked. If the servers are configured together in a Backend Group, the group is selected on the Load Balancer → Backend Groups screen and Edit is clicked; the fields below are applied to all the servers in the group.

5

Adım 5 Check SSL Service

SSL Service must be on (off by default); only then do the TLS fields appear. The port in the Address field is the server's TLS port (What is SSL bridging; how do I also encrypt the traffic to the backend?).

6

Adım 6 Turn on verification

Certificate Verification = Required is selected (default None); in the Verification CA Profile field that appears, the CA record from step 3 is selected. If the field is left as None, no verification is performed.

7

Adım 7 Specify the name

For the name in the certificate to be checked as well, the name in the server certificate is written in the SNI field (e.g. app01.example.local), or, for the name requested by the client to be sent, the Request HTTP header content variable (Header Name = Host) is added with the field's fx button (I need to send SNI when connecting to the backend; how do I set it up?). If SNI is left empty, only the chain is verified. The SNI field is applied only on an HTTP vService; on an L7 TCP vService, the name is not checked.

8

Adım 8 Save

Edit at the bottom of the form is clicked; the setting is applied to all the vServices that use the Backend Service. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1ConnectionTR7 side

In the Load Balancer → Backend Services list, the health status of the Backend Service and the responses coming through the vService are checked.

ExpectedThe Backend Service is healthy, the page opens

2Negative testBackend Service side

In a test environment, a certificate not signed by the selected CA is placed on the server, or a name that is not in the certificate is written in the SNI field.

ExpectedTR7 cannot connect to the server; requests receive an error

Method 2: WEB-CLI

• How it works SSL Service, the verification type, the CA record and SNI are written in the same command. --sslVerifyCa can be used only with --sslVerify required, and both only with --sslService true.
• Where it is opened TR7 WEB-CLI → lb backend update
• Requirement WEB-CLI access; a CA record (How do I add my own internal CA to TR7?)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Turn on verification

In place of <id>, the Backend Service, and in place of <ca>, the CA record is selected with Tab (SSL fields); since the command also keeps SSL Service on, it is used only on servers that listen with TLS:

lb backend update id <id> --sslService true --sslVerify required --sslVerifyCa <ca> --sni app01.example.local

Verification

1RecordTR7 side

Command: lb backend show <id>

ExpectedsslService true · sslVerify required · sslVerifyCa filled in

That the connection is verified is monitored from the health status, as in Method 1.

Common Mistakes

• Selecting Required without selecting a CA record. If Verification CA Profile is not selected, no verification is performed and the connection is still established; the form gives no warning in this case.
• Leaving SNI empty and assuming the name is checked as well. While SNI is empty, only that the certificate chains to the CA is checked; the certificate of another server signed by the same CA is also accepted.
• Selecting the wrong CA. The valid server cannot be verified either and cannot receive traffic; the selected record must be the CA that actually signed the server certificate (or the root in its chain).
• Assuming the server is verified while SSL Service is on. Certificate Verification is None by default; only encryption is performed.
• Trying to add a CA from the Backend Service form. The Verification CA Profile selector lists only the records on the Certificate Authorities (CA) screen; the CA is first added on that screen.

How it is done in the documentation

• Backend Services · Certificate Verification
• Backend Services · Verification CA Profile
• Backend Services · SNI
• Certificate Authorities (CA) · Add a trusted CA certificate

Related questions

• My backend uses a self-signed certificate; is that a problem?
• I need to send SNI when connecting to the backend; how do I set it up?
• How do I add my own internal CA to TR7?