Forum Discussion
Redirection from 443 to 80
Hi,
we have VIP on 443 and backend on 80. We have imported the certificate and configured the SharePoint 2007 service. when we access the service on VIP, it is offloading the certificate, but after that all the communication is going through the http.
do we need to write an iRules for the same..?
8 Replies
- Thomas_Gobet_91
Cirrostratus
Hi,
Can you be more precise on your problem ?
I don't understand if the offloading is your problem or if it's something else.- siyadh_121603
Nimbostratus
Hi Tomas, It not the issue of Offloading the ssl certificate. the issue is after offloading the certificate, all the traffic is happening as http.
- Thomas_Gobet
Nimbostratus
Hi,
Can you be more precise on your problem ?
I don't understand if the offloading is your problem or if it's something else.- siyadh_121603
Nimbostratus
Hi Tomas, It not the issue of Offloading the ssl certificate. the issue is after offloading the certificate, all the traffic is happening as http.
- smp_86112
Cirrostratus
This is a common problem. Sharepoint doesn't know that the clients are talking HTTPS, right? When it receives the traffic, it has already been decrypted and arrives on :80. There's several ways to handle this. The quick-and-dirty way is to apply an iRule to the HTTP VIP which redirects everything to HTTPS. Something like this: when HTTP_REQUEST { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" } The big downside of this approach is that it will result in one unnecessary TCP round-trip, every time it's used, for every client - probably, a lot of extra hops. In other words, generally speaking it will reduce the performance of the application. What you should do, in my opinion, is to tell Sharepoint that clients are really talking HTTPS - in other words, that "SSL is offloaded". But unfortunately for you, I'm not a Sharepoint expert so I don't know how to do this. Each application is unique. But hopefully someone with Sharepoint experience will chime in. - mikeshimkus_111Historic F5 Account
Sounds like you may need to configure Alternate Access Mappings on the SharePoint web app. Check out page 41 of this guide: http://www.f5.com/pdf/deployment-guides/iapp-sharepoint-2010-2013-dg.pdf
- smp_86112
Cirrostratus
> But hopefully someone with Sharepoint experience will chime in. See what I mean? Thanks for the reference mikeshimkus, that's exactly what I was talking about.
Have a look at stream profiles:
https://devcentral.f5.com/articles/ltm-stream-profile-multiple-replacements-regular-expressions
when HTTP_RESPONSE { if {[HTTP::status] ==200}{ STREAM::enable STREAM::expression "@http://@https://@" } }
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com