F5 Certificate Chain Configuration

Why Certificate Chains Matter

The Trust Problem

Browsers and clients don't automatically trust your certificate. They need a chain of trust connecting your certificate back to a root CA they already trust.

┌─────────────────────────────────────────┐
│         Root CA Certificate             │  ← Pre-installed in browsers/OS
│   (DigiCert, Sectigo, Let's Encrypt)    │     NOT sent by your server
└─────────────────────┬───────────────────┘
                      │ Signs
                      ▼
┌─────────────────────────────────────────┐
│     Intermediate CA Certificate         │  ← MUST be sent by your server
│                                         │     This is "the chain"
└─────────────────────┬───────────────────┘
                      │ Signs
                      ▼
┌─────────────────────────────────────────┐
│      Your Server Certificate            │  ← Sent by your server
│        (www.example.com)                │
└─────────────────────────────────────────┘

Why Some Clients Work Without the Chain

Modern browsers (Chrome, Firefox, Edge, Safari) will automatically fetch missing intermediate certificates using AIA (Authority Information Access) URLs embedded in your certificate.

Where to Configure Chain in F5

┌─────────────────────────────────────────────────┐
│ Certificate Key Chain                           │
├─────────────────────────────────────────────────┤
│ Certificate: www.example.com_2025          [▼]  │ ← Your cert
│ Key:         www.example.com_2025          [▼]  │ ← Your key
│ Chain:       DigiCert_Intermediate         [▼]  │ ← CHAIN GOES HERE
└─────────────────────────────────────────────────┘

Step-by-Step Chain Configuration

# Check that chain is being sent (should return 2 or more)
openssl s_client -connect your-vip:443 -servername your-domain.com 2>/dev/null | \
  grep -c "BEGIN CERTIFICATE"

# See the full chain
openssl s_client -connect your-vip:443 -servername your-domain.com -showcerts

F5's Silent Failure Mode

How This Happens

1. You had a DigiCert cert with DigiCert intermediate
2. You renewed with Sectigo
3. You updated the certificate but left the old DigiCert chain
4. F5 sees the mismatch and sends nothing
5. Chrome works (auto-fetches), mobile apps break

Detection

# Count certificates returned (should be 2+)
echo | openssl s_client -connect your-vip:443 -servername domain.com 2>/dev/null | \
  grep -c "BEGIN CERTIFICATE"

# If result is 1, your chain isn't being sent!

Common Causes

Multiple Intermediate Certificates

Some CAs have a chain of multiple intermediates:

Root CA
  └── Intermediate CA 1
        └── Intermediate CA 2
              └── Your Certificate

Creating a Bundle

F5's Chain field accepts a single certificate OR a bundle. For multiple intermediates:

# Order: Your issuer first, then the next level up
cat intermediate2.crt intermediate1.crt > chain-bundle.crt

# Verify the bundle
openssl crl2pkcs7 -nocrl -certfile chain-bundle.crt | \
  openssl pkcs7 -print_certs -noout

Import the Bundle

1. Import the bundle file as a single "certificate" in F5
2. Select the bundle in the Chain field

Verifying Your Chain

# Full chain verification
openssl s_client -connect your-vip:443 -servername domain.com -showcerts

# You should see output like:
# Certificate chain
#  0 s:CN = www.example.com
#    i:CN = DigiCert SHA2 Extended Validation Server CA
#  1 s:CN = DigiCert SHA2 Extended Validation Server CA
#    i:CN = DigiCert High Assurance EV Root CA

# Verify chain is valid
openssl s_client -connect your-vip:443 -servername domain.com -verify_return_error

Troubleshooting Chain Issues

# Check certificate count
openssl s_client -connect your-vip:443 -servername domain.com 2>/dev/null | \
  grep -c "BEGIN CERTIFICATE"
# If result is 1, chain is missing

# Check if chain matches your certificate's issuer
openssl x509 -in your-cert.crt -noout -issuer
# Output: issuer=CN = DigiCert SHA2 Extended Validation Server CA

# Verify your chain certificate matches
openssl x509 -in your-chain.crt -noout -subject
# Output should match the issuer above

Chain Configuration - tmsh Commands

# View current chain configuration
tmsh list ltm profile client-ssl my-profile cert-key-chain

# Update chain in existing profile
tmsh modify ltm profile client-ssl my-profile \
  cert-key-chain replace-all-with { \
    entry1 { \
      cert my-certificate \
      key my-key \
      chain my-intermediate \
    } \
  }

# Verify the change
tmsh list ltm profile client-ssl my-profile cert-key-chain

# Save configuration
tmsh save sys config

Quick Reference - Which Certificate Goes Where

Prevention Checklist

Frequently Asked Questions