For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

CraigM_17826's avatar
CraigM_17826
Icon for Altocumulus rankAltocumulus
Jan 30, 2009

Advice needed on using a single virtual Server for multiple web based apps

Hi,

 

 

my boss has asked me if the following is possible to have a single virtual server (with a SSL cert) for multiple web based applications. For example he would like to use our one SSL cert for WebSphere, PeopleSoft, OWA, and a few other web based apps. At the moment some of these have their own Verisign SSL certs, and some are using self signed certs. Now not being a BigIP guru I am not sure if this is possible, but he thinks it is, or was told by someone it was.

 

 

Although I can see at first glance this may be possible providing a unique URI can be allocated for each web based appplication

 

 

eg. /exchange for OWA

 

/wps/portal for WebSphere

 

 

I am concerned that these various apps may/will have conflicting persistence profiles or other settings that are applied at the virtual server level and not defineable within the iRule. For example, you can specify the pool as config option (default pool) or in the iRule. Can the other settings like

 

 

- default persistance Profile

 

- HTTP Profile

 

- VLAN List

 

 

be defined within the iRlule?

 

 

In the end my boss wants to reduce the costs of all the Verisgn SSL certs we use, and at $1600 each I can see some sense in this. I realise there are cheaper SSL certs like those from GoDaddy, but I don't know much about the company and how well they are supported by browswers.

 

 

Anyway I would appreciate any comments on whether the BigIP can do what Ive been asked to make it do. Any comments on GoDaddy SSL certs would also be welcome, assuming it doesn't violate any forum rules.

 

 

tia

 

 

Craig

 

 

application delivery
dev
devops
iRules

1 Reply

  • semperfiguy_759's avatar
    semperfiguy_759
    Icon for Nimbostratus rankNimbostratus
    Feb 06, 2009
    Craig,

     

    This is possible and common to do with a URI or TCP port switch iRule. If you are worried about different HTTP profiles etc. you could redirect to different VIPs on unique ports based on the URI. However, I would consult with Verisign to make sure you are not violating your agreement. They are specific on when you can use the same cert. Since you are terminating SSL on the BIGIP and not multiple copies on backend servers, you may not have any licensing issues.

     

     

    Here is a doc from Verisign.

     

    http://www.verisign.com/static/001496.pdf

     

     

     

    Hope this helps,

     

    Bob