Forum Discussion
AltocumulusMultiple Irule association based on SNI
Hi All,
I have a query
Think of a scenario where SNI is configured ( to have ABC.com and DEF.com serving from the same Virtual server).
We will call the Virtual server as SNI-VS.
ABC.com and DEF.com have 2 different sets of Certificates. (Signed by different CAs). So 2 diff Client SSL profiles.
I have an extra irule (An iRule that extracts client certificate details and inserts them into HTTP headers ) which is attached to virtual server SNI-VS (which is going to serve both the URLs stated above).
I want this extra Irule to kick in only when ABC.com traffic is processed and I need a different irule (not the one mentioned above) to kick in when DEF.com traffic is processed.
Is there a way to do this? Could you please share some F5 docs with which I can achieve this?
is it possible to have 2 different Irule for the same virtual server which is configured for SNI.
1 Reply
- xuwen
Cumulonimbus
use this code try it,here is the link about the irules for SSL::sni, https://clouddocs.f5.com/api/irules/SSL__sni.html
when HTTP_REQUEST {
if { [SSL::cert count] > 0 && [SSL::verify_result] == 0} {
if { [SSL::sni name] equals "ABC.com" } {
HTTP::header insert SSLClientCertSN [X509::serial_number [SSL::cert 0]]
}
}
}
