For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bicho6_66188's avatar
bicho6_66188
Icon for Nimbostratus rankNimbostratus
Dec 16, 2010

Multiple SSL Certs, One IP address

I'm currrently not an f5 customer, but i'm trying to figure out whether F5's SSL offloading solution will solve a problem of mine.     My company is a SaaS company that sells a Web Application...
config
design
David_Remington's avatar
David_Remington
Icon for Employee rankEmployee
Dec 16, 2010
Currently on BIG-IP you can support more than one hostname on an HTTPS virtual server in two ways:

1) Obtain a cert with one or more Subject Alternate Names. This is supported in all current and most recent browsers and allows a single cert to be used for several disparate hostnames.

 

2) Use a wildcard certificate, such as *.example.com which would serve for any hostname within example.com (ie: foo.example.com and bar.example.com but IE does NOT support two levels such as foo.bar.example.com so it is best to avoid that).

 

 

 

We do not currently support the Server Name Indication extension for TLS.

 

 

 

That being said, it is still not a fully-solving issue as for www.acme.com to provide seamless transition to your site they would have to give YOU their private key which is in general a bad idea.

 

 

 

You can mask this problem in a couple of ways:

 

1) Have them incorporate your site within an invisible frame. That way the URL bar in the browser stays the same.

 

2) Use a wildcard certificate and brand the hostname (acme.example.com).

 

 

 

I would definitely reach out to your local SE and discuss this.