Forum Discussion
goyogi
Nimbostratus
NimbostratusSSL verification
We do SSL offloading on the LTM but some of our sites are built to detect if the connection is coming in encrypted or not. We would rather not re-encrypt it back to the server for several reasons. I...
Justinian_48178Nimbostratus
NimbostratusWould you guys do this through a custom iRule or by custom http profile(s)? We currently inject FRONT-END-HTTPS: on for our secure sites, but we found out that if the client injects that header, we accept it and send them as if they are secure.
For the simple test we did we were able to get around that issue by creating a non-secure http profile that removed the header, and a secure http profile that added the header. We then built two virtual servers and applied the appropriate rule to each VS (port 80 and 443). Is this what everyone else is doing, or are you guys building a iRule to detect it being sent from the client before injecting it to the server?
