The BIG-IP Administrator has to provide encrypted communication between the users and the virtual server they access. Multiple hostnames are…

To secure traffic between users and the virtual server, a Client SSL profile is required on the BIG-IP. This profile terminates the client's SSL/TLS connection. When multiple hostnames resolve to the same virtual server IP address, Server Name Indication (SNI) must be used. SNI allows the client to specify the intended hostname in the TLS handshake. The BIG-IP uses this information to select and present the correct server certificate. This functionality is enabled in the Client SSL profile by configuring the "Server Name" setting, which makes the profile SNI-aware.

A. Client SSL is the correct profile type, but "Client Name" is not the setting used for SNI; the correct setting is "Server Name".

B. A Server SSL profile is used to re-encrypt traffic from the BIG-IP to backend servers, not for user-to-virtual-server communication.

C. A Server SSL profile is for BIG-IP to backend server communication, and while it has a "Server Name" setting for SNI, it's the wrong profile for this scenario.

1. F5 Networks. (2021). BIG-IP System: SSL Administration, version 16.1. "Configuring the BIG-IP System to use SNI to secure traffic for multiple sites". This section details using a Client SSL profile with the Server Name setting to support multiple hostnames on a single virtual server.

2. F5 Networks. (2021). BIG-IP System: SSL Administration, version 16.1. "Client SSL profile settings". The documentation specifies the "Server Name" setting as the field for the fully-qualified domain name of the server, used for SNI.