Forum Discussion
kazeem_yusuf1
Nimbostratus
NimbostratusAn Irule for Client Ssl Profile that Allows Unassigned TLS Extension Values (17516)
Hello Community,
I have a requirement to allow enriched https header enrichment. The SSL negotiation (I'm doing ssl termination on F5) fails because the enriched header from client contains res...
Stan_PIRON_F5
Employee
Employeewhen CLIENTSSL_HANDSHAKE {
if { [SSL::extensions exists -type 17516] } then {
set tls_extension [SSL::extensions -type 17516]
} else {
set tls_extension ""
}
}
when SERVERSSL_CLIENTHELLO_SEND {
if { $tls_sni_extension ne "" } then {
SSL::extensions insert $tls_extension
}
}this code is a copy of this code with your extension type
https://devcentral.f5.com/s/articles/client-side-to-server-side-sni-relay-irule-967
Baba_TABOURENimbostratus
NimbostratusThanks Stanislas, is this the reason why we have that kind of error sent during TLS Handshake?:
Alert (Level: Fatal, Description: Bad Record Mac).
Our F5 is the first network element we have before getting to the server.
