Forum Discussion
Sully728_88740
Nimbostratus
NimbostratusHow to require SSL certificate for a single host header
Hope some one can help.
What we have to day is a single VIP with the SSL Client profile certificate set to ignore. The current i-rule handles three host headers. Moving forward we want to require the client certificate on example1 and example2 host headers and leave example3 at ignore.
Here is the current i-rule.
when HTTP_REQUEST {
if { ( [string tolower [HTTPS::host]] contains "example1.com" ) } {
pool example1
} elseif { ( [string tolower [HTTPS::host]] contains "example2.com" ) } {
pool example2
} elseif { ( [string tolower [HTTPS::host]] contains "example3.com" ) } {
pool example3
}
else { discard }
}
- dennypayne
Employee
The example in the wiki for SSL::renegotiate looks like it has similar logic to what you'd need. (Click here)
Denny - To change profile options in an iRule you're going to have to swap between profiles. Denny's suggestion is a good one, check out the renegotiate command.
Colin
