Using the SSL::renegotiate command

Hi,

 

 

I have a user who wants to use different SSL certificates for different domains, but they are all on the same virtual server.

 

What they want to do for example is:

 

 

client requests abc.example.com -> use certificate abc

 

client requests def.example.com -> use certificate def

 

 

I would think it can be done by using the SSL::renegotiate command, but since the first time the HTTP Request gets to the BIG-IP is after the initial SSL handshake, we would first need to use a wildcard certificate, right?

 

 

As for the rule is concerned, I think it would look something like this:

 

 

when HTTP_REQUEST {

 

if { [HTTP::host] contains "abc"} {

 

SSL::profile abc_profile

 

SSL::renegotiate

 

} elseif { [HTTP::host] contains "def"} {

 

SSL::profile def_profile

 

SSL::renegotiate

 

}

 

}

 

 

Any other suggestions or comments on how to write this rule?

 

Are there many users that actually use this command for this kind of "two step" negotiation?

 

 

Thanks