Forum Discussion
irule prepend www to https request
I am using the irule below for an external virutal https site. The objective is to check for client https requests where the user leaves out the www. I am testing with IE , Firefox, and Chrome browsers. The results are inconsistent. When I make the first client attempt to browse to https://test.mydomain.com, I would get the typical cert error page using IE for example. Checking the irule stats, I can see the irule never processed(reset the stats before each attempt) . I would click through the warning and the irule would process and the cert works successfully. If I use the same browser that day or the next and go to https://test.mydomain.com, the irule processes , the cert works and all is good. I am thinking something is getting cached, do you have any idea what would cause this? I am clearing the cache on the browser each time before I try again. On the first attempt, IE returns the cert error page, the irule is not processed. Is this because the SSL client profile is accessed before the irule? The SSL profile is expecting www.test.mydomain.com (cert is www.test.mydomain.com) and the cert fails when it sees test.mydomain.com.
when HTTP_REQUEST { log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] to [HTTP::host][HTTP::uri]" switch -glob [string tolower [HTTP::host]] { "www." { log local0. "Doing nothing." } {[a-z]*} { HTTP::redirect "https://www.[HTTP::host][HTTP::uri]" log local0. "Redirecting non-www host to www.[HTTP::host][HTTP::uri]" } } }
2 Replies
- IheartF5_45022
Nacreous
Hi, SSL client processing takes place before HTTP_REQUEST is fired (as until SSL is complete, TMM cannot read the request details).
The browsers do all behave slightly differently (and between versions), but in general when you click OK in the browser to view the page you are essentially caching that cert for the mismatching domain for the duration of the browser session - I don't think that clearing cache removes it - you need to close either that window or all windows to get rid of the caching.
If you need your site to perform a redirect from https://test.mydomain.com to https://www.test.mydomain.com then you will need to include the test.mydomain.com FQDN as a Subject Alternative Name in your certificate, otherwise users will get the cert error.
- GeorgeA_32263
Nimbostratus
IheartF5: I greatly appreciate your explanation. Now things make sense. Thank you.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com