Forum Discussion
Pamela_Pelletie
Nimbostratus
NimbostratusSSL certificate
Hi, I have 2 SSL cetificates. Each of them have a different name but they are used for the same IP address. I've create a pool which include 2 nodes with 2 different IP addresses. For the virtual server, I need help : there's CNAMEs associated with the same IP address. I wanna be able to choose which certificate to load when one of the CNAME is choosen. Is it possible? An iRule?
- I don't think that would be possible even with an iRule, since the Host: header is encrypted until after the handshake, and the hostname must be known to choose the proper certificate for the handshake.
/deb 
Hannes_RappLook into TLS SNI
- Background: https://devcentral.f5.com/articles/ssl-profiles-part-7-server-name-indication
- Configuration: https://support.f5.com/kb/en-us/solutions/public/13000/400/sol13452.html
Not all Web Browsers support TLS SNI. Enforcing TLS SNI today will cut off the automatic web-site trust for about 0.3% of end-users that have legacy Web Browsers. These clients will receive an untrusted site warning, and must confirm a security exception to proceed to visit the site.
Do not blindly take this number as a fact, this is what I've personally observed in my customer environment. If you are in Health Care business where the majority of customers are elderly people with outdated Windows XP desktops, you may want to avoid implementing this technology :)
