Forum Discussion
NimbostratusHttp Redriect Loop
Hi,
I want to do redirect from HTTP to HTTPS. I have set iRule.
when HTTP_REQUEST { HTTP::redirect "https://[HTTP::host][HTTP::uri]" }
On firefox, it loop but on chrome it's working ok. iRule on http virtual server. Virtual server have http and https. Also i have cert ssl install on F5. Please advice.
Thanks.
27 Replies
- nitass
Employee
Can i use this command: ssldump -k /config/ssl/ssl.key/our-domain.key -i 1.1 port 443 -A -d
yes but it may be better to capture both clientside (between client and f5) and serverside (between f5 and server). there is special interface 0.0 which will capture traffic from all vlan.
e.g.
ssldump -k /config/ssl/ssl.key/our-domain.key -i 0.0 port 443 or port 80 -A -danyway, it may be good to save packet to file (using tcpdump) and decode/decrypt it later (using ssldump or wireshark).
e.g.
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap port 443 or port 80 -vDecrypting SSL traffic with Wireshark, and ways to prevent it
http://wirewatcher.wordpress.com/2010/07/20/decrypting-ssl-traffic-with-wireshark-and-ways-to-prevent-it/ 
Zainal_Abidin_1Please view log file using ssldump:dump3.log
- Kevin_Stewart
Well, the good news is that you appear to have a good ssldump capture. The bad news is that the capture contains a lot of application layer traffic (HTML, JavaScript, CSS, etc.), which generally indicates that SSL is not the problem. So then the next question is, did ANYTHING else besides the certificate change? Your Firefox client is consuming the layer 7 data and interacting with the server, so there must be something else at play here. At this point I'd spin up a Fiddler capture and see where things are getting stuck.
- Zainal_Abidin_1
Can you verify problem if i give tcpdump file?
- Zainal_Abidin_1
This is from tcpdump:tcpdump. I'm not familiar with tcpdump.
- Zainal_Abidin_1
I think problem with aging rate on persistence HTTP. Let user try first will update here soon.
- Kevin_Stewart
A few things worth noting:
-
It's hard to tell in the capture who is who. I do some odd "port number reuse" errors towards the end, and a good mix of port 80 and 443 traffic.
-
It might be possible that there's a persistence issue, but I'd imagine that would affect all browsers, not just Firefox.
-
Towards the end of your ssldump, I see reference to a PDF mime type. Are you by chance attempting to view a PDF in the browser when it fails?
-
