Forum Discussion
NimbostratusPull global variable from data group list
CirrostratusI haven't tested this, but could you use HTTP::respond from ASM_REQUEST_BLOCKING to replace the redirect?
when ASM_REQUEST_BLOCKING {
set redirectTo "http://www.domain.com/not_found.htm?$asm_query_string"
HTTP::respond 302 Location $redirectTo
}
Also make sure to validate the query string on your PHP app which displays the error text. At a minimum you could HTML encode any text you display back to the user to avoid a XSS vulnerability.
Aaron
IanBEmployee
What you're trying to do is exactly what the chain of trust that SSL uses to verify a website was designed to prevent.
I'm simplifying slightly, but when a certificate is issued for a website, it is signed by a trusted authority. That authority is deemed to be trusted because their root certificates are implicitly trusted by the browser. Geotrust, Digitrust, etc all have certificates that are pre-installed on every current operating system. In other words, when the website's certificate says it is valid for *.f5.com, that statement is signed by a chain of certifcates that end in one that the browser implicitly trusts.
Having said that, if you control the clients and have installed your certificate on them and told them to trust it as root CA, then you can set up a scenario where the BigIP is able to substitute the real website's certificate with one that it generated and signed on the fly, and the client will trust it because it trusts the signer.
We have a document which explains in more detail how it works, and how to configure it If you're interested, please take a look at our SSL intercept deployment guide
Note that if you were to deploy this without the trusted root certificate on the client, then any browser being directed through the service would alert the user that every https:// site's certificate could not be validated.
- Kai_Wilke
MVP
Hi Cathy,
after Ian's answer, I'm somewhat unsure if you need the stealth redirect in a forward proxy (aka. a Browser accesses the internet) or a reverse proxy scenario (aka. the internet access your web servers.
I you need the stealth redirect in a forward proxy scenario then Ian's answer would be the solution.
But if you need the silent redirect in a reverse proxy scenario, then you have to configure SSL-Termination of your Virtual:443, by assigning a Client- and Server-SSL-Profile. In this case the F5 can terminate and inspect the HTTPS request and then perform any kind of content manipulation.
Cheers, Kai
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
