Forum Discussion
juan_baptiste_4
Nimbostratus
Jan 18, 2010irule to redirect in HTTPS to avoid bad certificate warning
Hi,
Probably I already know the answer to what I'm about to ask, but I need to be sure. Here's the problem:
for a web site, we have two domains:
www.mycompany.com and other.mycompany.com
The first one is the main site where users connect to initially, but they're redirected to the other site, when they enter using HTTP using an irule. Both sites are hosted on the same machine, hence, they have the same IP address and the same Virtual Host. This irule redirects petitions to http://www.mycompany.com/foo to https://other.mycompany.com/foo and works fine. The SSL certificate is for other.mycompany.com and not www.mycompany.com, which is installed with a client SSL profile and assigned to the Virtual server, and here's where the trouble comes. When a user uses HTTPS instead of HTTP to enter to the main site, ex: https://www.mycompany.com/foo, he obviously will get a certificate warning as the host name in the certificate doesn't correspond to the host name of the site they are accessing. We were trying to write an irule to do a redirection from https://www.mycompany.com/foo to https://other.mycompany.com/foo using the HTTP host header before the user get's the warning message, but if my understanding is correct this cannot be done. The HTTP header is accessible in the HTTP_REQUEST event, which happens after the SSL handshake where is when the warning message appears to the user, so we can't use HTTP haders to do this.
My question is, I'm correct and this redirection can't be done and we will need to buy a certificate for www.mycompany.com or is another way to do this redirection ?
- JRahm
Admin
A wildcard certificate would handle any of the *.mycompany.com domains, but you are correct that a certificate warning cannot be worked around short of the presence of a certificate that covers the before/after domains, or a controlled client base that defaults to using the TLS SNI extension. If the client base is controlled, you could write an iRule to switch profiles based on the SNI information. - JRahm
Admin
If all your domains are one.test.com, two.test.com, three.test.com, etc, a wildcard certificate will work just fine in this scenario. You'll still get a warning for test.com, but as long as their is a subdomain present for test.com, it will work fine. This would still be configured the same as a single clientssl profile. - JRahm
Admin
the name arrives encrypted, so a decryption must take place BEFORE the name is analyzed, so there really isn't a way to switch the profiles on the BIG-IP like desired if you don't control the client base. - F5
- hoolio
Cirrostratus
http://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/afv/topic/aft/1174596/aff/5/showtab/groupforums/Default.aspx
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects