How to choose which virt based on header

Do you want both virtual servers to use the same IP address? If so you have a catch-22 as you have to decrypt the traffic *before* an iRule can inspect the HTTP header. The earliest possible event during which you would be able to discern the hostname in the request is CLIENTSSL_HANDSHAKE which is invoked *after* the decryption.

 

 

If you have the two hostnames on different IPs, this is easy and you don't need an iRule at all, just use the appropriate cert on each virtual server.

 

 

I have a customer who has had success with using certificates with subject alternative names to allow a single vip and a single cert to service multiple hostnames, which resolves the very problem you are having.