Forum Discussion

GeorgeA_32263's avatar
GeorgeA_32263
Icon for Nimbostratus rankNimbostratus
Feb 21, 2014

irule prepend www to https request

I am using the irule below for an external virutal https site. The objective is to check for client https requests where the user leaves out the www. I am testing with IE , Firefox, and Chrome browsers. The results are inconsistent. When I make the first client attempt to browse to https://test.mydomain.com, I would get the typical cert error page using IE for example. Checking the irule stats, I can see the irule never processed(reset the stats before each attempt) . I would click through the warning and the irule would process and the cert works successfully. If I use the same browser that day or the next and go to https://test.mydomain.com, the irule processes , the cert works and all is good. I am thinking something is getting cached, do you have any idea what would cause this? I am clearing the cache on the browser each time before I try again. On the first attempt, IE returns the cert error page, the irule is not processed. Is this because the SSL client profile is accessed before the irule? The SSL profile is expecting www.test.mydomain.com (cert is www.test.mydomain.com) and the cert fails when it sees test.mydomain.com.

 

when HTTP_REQUEST { log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] to [HTTP::host][HTTP::uri]" switch -glob [string tolower [HTTP::host]] { "www." { log local0. "Doing nothing." } {[a-z]*} { HTTP::redirect "https://www.[HTTP::host][HTTP::uri]" log local0. "Redirecting non-www host to www.[HTTP::host][HTTP::uri]" } } }

 

2 Replies

  • Hi, SSL client processing takes place before HTTP_REQUEST is fired (as until SSL is complete, TMM cannot read the request details).

     

    The browsers do all behave slightly differently (and between versions), but in general when you click OK in the browser to view the page you are essentially caching that cert for the mismatching domain for the duration of the browser session - I don't think that clearing cache removes it - you need to close either that window or all windows to get rid of the caching.

     

    If you need your site to perform a redirect from https://test.mydomain.com to https://www.test.mydomain.com then you will need to include the test.mydomain.com FQDN as a Subject Alternative Name in your certificate, otherwise users will get the cert error.

     

    • GeorgeA_32263's avatar
      GeorgeA_32263
      Icon for Nimbostratus rankNimbostratus
      IheartF5: I greatly appreciate your explanation. Now things make sense. Thank you.