F5 Networks F5CAB3 Exam - Topic 1 Question 19 Discussion

When a single IP address (Virtual Server) must host multiple hostnames (e.g., site1.com, site2.com) over HTTPS, the BIG-IP must be able to present the correct SSL certificate for each site during the initial handshake. This requirement is handled by a technology called Server Name Indication (SNI).

To implement this on the BIG-IP, the administrator must use a Client SSL profile because the encryption is occurring between the user (Client) and the Virtual Server. Within the Client SSL profile settings, there is a field called Server Name. By creating multiple Client SSL profiles---each with a different 'Server Name' (the hostname) and its corresponding certificate---and attaching them all to the same Virtual Server, the BIG-IP can inspect the SNI extension in the client's 'Client Hello' packet. It then selects the specific profile that matches the requested hostname.

Option A is incorrect because 'Client Name' is not the standard field name used for SNI hostname matching in the profile. Options B and C refer to Server SSL profiles, which manage the connection between the BIG-IP and the backend servers. While Server SSL profiles also have a 'Server Name' field (used to send SNI to a backend server), the requirement here is to provide encrypted communication for 'users' accessing the virtual server, which definitively requires a Client-side SSL configuration.