For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

IWhitmore's avatar
IWhitmore
Icon for Nimbostratus rankNimbostratus
Jun 10, 2014

Redirect SSL to SSL with header rewrite and certificates

Hi all. I have a question on using 301 or 302 redirects and SSL. I'm not sure if this can be solved by iRules.   The problem is the following:   X.bb.com is 1.1.1.1. If a user tries to connect ...
application delivery
BIG-IP DNS
design
devops
iRules
LTM
Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
Jun 10, 2014

You can actually specify multiple client SSL profiles (hence multiple certificates) on one virtual server based on TLS SNI. This may be of use to you.

 

http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13452.html

 

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Jun 10, 2014
    Thanks Cory! That was new to me and looks really promising. If his clients supports TLS that's an eligible option. Hope F5 gets native support for it later. /Patrik
  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Jun 10, 2014
    The demise of Windows XP finally made this option truly available, as it was just about the only OS (i.e. all versions of IE on XP) that isn't compatible with SNI. Of course this limitation still applies if a significant portion of a site's visitors are using XP. Many governments are paying Microsoft for extended support since they're still using XP.
  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Jun 10, 2014
    I made a study of our user base and close to 10% of them uses SSLv3. Agent strings suggests the culprits to be Xp, MacOs and Linux. I never imagined it to be that high.