For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ramr_261905's avatar
ramr_261905
Icon for Nimbostratus rankNimbostratus
May 05, 2016

How to configure a virtual server with serverssl profiles to talk to both HTTP and HTTPS backends?

In our F5 (version: 11.6.0) setup: 1. SSL is being terminated on the F5 end. 2. Connections on the serverside (to the backend pool) can be either HTTP or HTTPS. Each pool can contain backends tha...
BIG-IP
cloud
iRules
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
May 07, 2016

We assumed (maybe incorrectly but this does work) that the SNI name in the serverssl profile would be used to match up to what the backend "served" up and so validate the backend certificate.

 

It does not. The SNI is only used by the server, if at all needed.

 

2, so we are doing this for a cluster where we programmatically add pools/serverssl profiles/certs etc and so we could need to keep a track of all hosts we added serverssl profiles for. So one suggestion we had was to create a datagroup that contains that set of host names and key enabling ssl serverside off of that

 

The data group option is probably the best option. You simply need to know, based on the Host header, whether or not to use server side SSL, correct? You could also include the pool in that data group if you're also switching between pools.