For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jair_Candia's avatar
Jair_Candia
Icon for Nimbostratus rankNimbostratus
Jun 29, 2022

Bypass Host

Hi I have multiples websites hosted in same virtual server. But these websites are from differents domains; e.g. "corporate.com" and "corp.net" "corp.net" use letsencrypt for the certificates, so t...
devops
CA_Valli's avatar
CA_Valli
Icon for MVP rankMVP
Jul 04, 2022

Hello Jair_Candia

If I'm interpreting te problem right, you have SSL issue due to SNI mismatch when you access corp.net service.

My guess would be, your VS might be missing SSL configuration. I wanted to understand better if you have any restraints in importing corp.net certificate on F5 because this will make configuration easier. 

For multiple SNI support you can configure a second clientSSL profile with explicit "corp.net" SNI (or wildcard equivalent) and make "corporate.com" clientSSL profile default for all SNI. Of course, if certificate changes every three months you should remember to upload it on F5 every time. 

If you need F5 to pass-through SSL for corp.net only, configuration is trickier. Easiest way, if possible, is to have different Virtual Servers - one with and one without SSL profiles.

If they must coexist on same VS, you need to perform the SSL disable operations ar right time in traffic flow. HTTP_REQUEST event is too late since SSL handshake already happened. I believe your best bet would be CLIENT_ACCEPTED event - this is TCP handshake, but in this case you should write matching conditions based on TCP properties. Or, (I'm not sure about this), you might be able to disable SSL on CLIENTSSL_CLIENTHELLO event and in this case you should be able to match SNI. You should also disable serverSSL on matching serverside event.