re: Configuring RRAS based SSTP VPN server behind F5 BIGIP SSL load balancer

adimcev — Tue, 26 May 2009 19:44:55 GMT

Samir wrote:

"SSL Certificates: Import the SSL certificate that will be used during HTTPS negotiation. Please note: the subject name (CN) of the certificate should be same as the VPN destination name as configured inside VPN client."

This may be partially correct for Windows SSTP clients. -;)

If the certificate contains a SAN DNS Name entry, then this name will be verified by the client(at least according to my tests), if failed, the error on the SSTP client is inaccurate(will say that the CN was wrong, which was not the case).

In practice, the CN may be the same with the SAN DNS Name entry, so one could not tell the difference and likely will not get any errors.

If the SAN on the server's certificate contains multiple DNS Name entries, the SSTP client appears to be capable to "consume" these entries(at least I saw this behavior with Vista SP2 RC and Win 7 RC SSTP clients, which is pretty cool).

The client's SSL Hello message contains the Extension: server_name with the name of the server configured on the VPN connection.

Thanks,

Adrian

How to configure RRAS based SSTP VPN server behind F5 BIGIP SSL load balancer

re: Configuring RRAS based SSTP VPN server behind F5 BIGIP SSL load balancer