Forum Discussion

rhawkins_76959's avatar
rhawkins_76959
Icon for Nimbostratus rankNimbostratus
Aug 24, 2007

app check for ssl when cert is on F5

Apologies if this is not the correct forum for this question...

 

 

We have apps (jsp in this case) that are checking for an http vs https connection from the client to the web server. After moving the ssl cert to the F5 and off the server, that no longer works.

 

 

It loops actually since it checks for http, if it is, redirects to https - since it's always http from the F5 -> server...

 

 

Other than writing an irule for all the pages they want to check and redirect, is there a way around this? A way they can verify with the F5 or client that a given page is secure? Someone must have come across this.

 

 

I suppose we could self cert the web server to secure it all the way through, but we want all SSL off the server.

 

 

Thanks all!!

 

 

-Rich
config
design
  • James_Thomson's avatar
    James_Thomson
    Icon for Employee rankEmployee
    Aug 24, 2007
    most people tell the BIG-IP to insert an HTTP header (i.e.-HTTPS=true) and then the server checks for this header when deciding to redirect or not. Here's an example for weblogic. https://tech.f5.com/home/solutions/sol4443.htmlcommandline
  • rh_75081's avatar
    rh_75081
    Icon for Nimbostratus rankNimbostratus
    Sep 18, 2007

    Posted By j.thomson on 08/24/2007 8:20 AM

     

     

    most people tell the BIG-IP to insert an HTTP header (i.e.-HTTPS=true) and then the server checks for this header when deciding to redirect or not. Here's an example for weblogic. https://tech.f5.com/home/solutions/sol4443.htmlcommandline

     

     

     

    I have a similar requirement where the F5 terminates SSL connections and passes thru http requests to an Apache httpd server onto a Weblogic Server.

     

    I do not have access to the particular URL mentioned above - but going by your suggestion would be a bit cumbersome in our application since we have redirects in many different places within our JSP pages. Was wondering if there was a way to preserve the requestScheme for the requesting HTTPRequest without having to trap the HTTP header? This seems to be preserved when the SSL termination is done within Apache. The http request that is forwarded by the WebLogic plugin to the WLS server has the right requestScheme(https)

     

     

    Thanks

     

     

    Ramdas
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Sep 18, 2007
    Hi Ramdas --

     

     

    You can get access to the AskF5 site by registering here: Click here

     

     

    Do you need to re-write redirects sent thru LTM from http to https?

     

     

    Or do you need to tranlsate server-referencing links in the payload from http to https?

     

     

    Or something else?

     

     

    /deb
  • rh_75081's avatar
    rh_75081
    Icon for Nimbostratus rankNimbostratus
    Sep 19, 2007
    Deb,

     

     

    I am not sure which category my problem falls into. Basically what was happening was that https requests were being terminated by the F5. The requesting scheme that was being passed into the WLS appserver was http instead of https and hence the request to the redirected page went over http. I wanted the incoming scheme to be recognized by WLS as being https.

     

    Was able to achieve this by the following solution.

     

     

    https://tech.f5.com/home/solutions/sol4443.html

     

     

    Solution ID: SOL4443

     

    Configuring the BIG-IP LTM to add a header so that BEA WebLogic

     

    nodes will generate redirects and links that specify the HTTPS protocol

     

     

    Thanks

     

     

    Ramdas