Forum Discussion

ztan's avatar
ztan
Icon for Nimbostratus rankNimbostratus
Mar 03, 2025

Disable ssl or https for the embed url

I created the iApp application service using secure web gateway template, I noticed when we go the webpage, z-INTEL, that we can't load some chart and diagram from embed the https url, https://cdn.fusioncharts.com/fusioncharts/3.17.0/fusioncharts.js

Failed to load resource: NET::ERR_CONNECTION_RESET. check the ltm and apm log, it shows handshake failure or TLSv protocol, I disbable TLSv1.0 and TLSv1.1 in ssl client and server profile, it not working. then try SSL forward proxy bypass based on document as follow, still not figure out issue.

SSL Forward Proxy Bypass

I try use iRule disable https or ssl, not working

when HTTP_REQUEST {
    if { [HTTP::host] equals "cdn.fusioncharts.com"} {
        set HTTPS off;

     # set sslclient disable

     # set sslserver disable
    }
}

Redirect https to http, not working

when HTTP_REQUEST {
    # Check if the request is coming from host cdn.fusioncharts.com
    if { [HTTP::host] equals "cdn.fusioncharts.com"} {
        # Redirect specific hosts path to HTTP
        switch -glob [HTTP::path] {
            "/fusioncharts/3.17.0/fusioncharts.js" {
                HTTP::redirect "http://cdn.fusioncharts.com/fusioncharts/3.17.0/fusioncharts.js"
            }
            "/fusioncharts/3.17.0/fusioncharts.maps.js" {
                HTTP::redirect "http://cdn.fusioncharts.com/fusioncharts/3.17.0/fusioncharts.maps.js"
            }
            "/fusioncharts/3.17.0/maps/fusioncharts.usa.js" {
                HTTP::redirect "http://cdn.fusioncharts.com/fusioncharts/3.17.0/maps/fusioncharts.usa.js"
            }
            "/fusioncharts/3.17.0/themes/fusioncharts.theme.fusion.js" {
                HTTP::redirect "http://cdn.fusioncharts.com/fusioncharts/3.17.0/themes/fusioncharts.theme.fusion.js"
            }
        }
    }
}

I had open f5 technical support ticket 2 times, still not figured out this issue, really appreciate your help in advance.

 

1 Reply

  • Hi Ztan,

    Since the webpage is running SSL, disabling SSL or redirecting to http will not work.

    The problem may be caused by SSL SNI. When I send request to cdn.fusioncharts website without SNI extension in Client hello package, I get reset packet. 

    I am not sure if there is a configuration for SNI in the Secure Web Gateway configuration. The following article says the following: For SSL-encrypted traffic, select Use SNI in Client Hello (if SNI is not available, use Subject.CN) or Use Subject.CN in Server Cert.
    https://techdocs.f5.com/en-us/bigip-15-0-0/big-ip-access-policy-manager-secure-web-gateway/per-request-policy-configuration-for-swg.html