For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VDaya_180260's avatar
VDaya_180260
Icon for Nimbostratus rankNimbostratus
Aug 05, 2015

http urls in content rewrite to https

Hi I have an multiple web servers that I'm load balancing using an irule for pool selection based on url entered in the browser and offloading SSL to the F5. The first part (HTTP_REQUEST) looks fine...
application delivery
devops
iRules
LTM
management
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Aug 05, 2015

You want to select a different client SSL profile for each request (as in multiple URLs pointing to the same VIP)?

 

There are at least two rather easy ways to do this:

 

  1. A single client SSL profile with a wildcard or SAN (subjectAltName) server certificate.

     

  2. Server Name Indication (SNI) configured with multiple client SSL profiles.

     

    https://support.f5.com/kb/en-us/solutions/public/13000/400/sol13452.html?sr=47417750

     

Ultimately you cannot change the client SSL profile in an HTTP event because by the time you get to HTTP (OSI layer 7), SSL decryption (OSI layer 5/6) has already happened. SNI comes with one caveat in that it isn't supported on older clients that don't support the TLS ServerName extension. This generally includes Windows XP and IE6 (and below).