Forum Discussion

juan_baptiste_4's avatar
juan_baptiste_4
Icon for Nimbostratus rankNimbostratus
Jan 18, 2010

irule to redirect in HTTPS to avoid bad certificate warning

Hi,

 

 

Probably I already know the answer to what I'm about to ask, but I need to be sure. Here's the problem:

 

 

for a web site, we have two domains:

 

 

www.mycompany.com and other.mycompany.com

 

 

The first one is the main site where users connect to initially, but they're redirected to the other site, when they enter using HTTP using an irule. Both sites are hosted on the same machine, hence, they have the same IP address and the same Virtual Host. This irule redirects petitions to http://www.mycompany.com/foo to https://other.mycompany.com/foo and works fine. The SSL certificate is for other.mycompany.com and not www.mycompany.com, which is installed with a client SSL profile and assigned to the Virtual server, and here's where the trouble comes. When a user uses HTTPS instead of HTTP to enter to the main site, ex: https://www.mycompany.com/foo, he obviously will get a certificate warning as the host name in the certificate doesn't correspond to the host name of the site they are accessing. We were trying to write an irule to do a redirection from https://www.mycompany.com/foo to https://other.mycompany.com/foo using the HTTP host header before the user get's the warning message, but if my understanding is correct this cannot be done. The HTTP header is accessible in the HTTP_REQUEST event, which happens after the SSL handshake where is when the warning message appears to the user, so we can't use HTTP haders to do this.

 

 

My question is, I'm correct and this redirection can't be done and we will need to buy a certificate for www.mycompany.com or is another way to do this redirection ?
  • A wildcard certificate would handle any of the *.mycompany.com domains, but you are correct that a certificate warning cannot be worked around short of the presence of a certificate that covers the before/after domains, or a controlled client base that defaults to using the TLS SNI extension. If the client base is controlled, you could write an iRule to switch profiles based on the SNI information.
  • If all your domains are one.test.com, two.test.com, three.test.com, etc, a wildcard certificate will work just fine in this scenario. You'll still get a warning for test.com, but as long as their is a subdomain present for test.com, it will work fine. This would still be configured the same as a single clientssl profile.

     

     

    HTH...Jason
  • the name arrives encrypted, so a decryption must take place BEFORE the name is analyzed, so there really isn't a way to switch the profiles on the BIG-IP like desired if you don't control the client base.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/afv/topic/aft/1174596/aff/5/showtab/groupforums/Default.aspx

     

     

    Aaron