For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Geir_Sandbu_342's avatar
Geir_Sandbu_342
Icon for Nimbostratus rankNimbostratus
Sep 04, 2009

add www to a https host

One of our customers uses a certificate for his website. The certificate is assigned to https://www.customer.com.

 

 

So when somebody types https://customer.com as the URL, they get a certificate error. I need to change the HTTPS request from https://customer.com to https://www.customer.com.

 

 

This is probably done by a simple irule, but I am not able to find a solution to this. I have also searched this forum after something that could help me on the way, but nothing so far.

 

 

Can anyone please help?

 

 

Thanks.
application delivery
dev
devops
iRules

5 Replies

  • Joe_Pruitt's avatar
    Joe_Pruitt
    Sep 04, 2009
    That's actually very simple to do. Apply this iRule to their Virtual server and they should be all set. 

     when HTTP_REQUEST {  
   if { !([string tolower [HTTP::host]] starts_with "www.") } {  
     HTTP::redirect http://www.[HTTP::host][HTTP::uri]"  
   }  
 }

    This will essentially check the value of the Host header and if it doesn't start with "www." it will issue a HTTP redirect to the client browser with www. added to the beginning of the URI.

    If the customer doesn't want to do this for all requests, but only for the single domain "customer.com", you could do something like this: 

     when HTTP_REQUEST {  
   if { [string tolower [HTTP::host]] eq "customer.com" } {  
     HTTP::redirect "http://www.customer.com[HTTP::uri]"  
   }  
 }

    Hope this helps...

    -Joe
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Sep 04, 2009
    I wanted to add the SSL handshake will occurbefore any iRule is processed, which means that the customer's clients will receive cert err before the redirection occurs. This is more or less a limitation of SSL Traffic.

     

     

    thanks,

     

    CB

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Sep 07, 2009
    If you're able to redirect the HTTP request from http://customer.com to https://www.customer.com, then you'll avoid the mismatched cert warning. Else, you might be able to get a UCC SSL certificate which is valid for customer.com and www.customer.com. In that case, you wouldn't need an iRule.

     

     

    Aaron
  • Geir_Sandbu_342's avatar
    Geir_Sandbu_342
    Icon for Nimbostratus rankNimbostratus
    Sep 08, 2009
    Thanks for the quick replies folks.

     

     

    But unfortunately it won't work. I tried to implement both the irule examples above. But coudn't get to the website.

     

    When I turn off the irule and the http profile, it works, but with the certificate error of course. When I try to add the irule without the http profile I get this message:"HTTP_REQUEST event in rule (test2) requires an associated HTTP or FASTHTTP profile on the virtual server"

     

     

    Any suggestions?

     

     

    Thanks
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Sep 08, 2009
    In order to parse, inspect or modify the HTTP content in an HTTPS request, you'll need to decrypt the SSL using a client SSL profile. If you want to use native HTTP:: iRule commands, you'll need to add an HTTP profile. See my last post on two possible solutions for avoiding the cert mismatch error.

     

     

    Aaron