For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kim_Busho's avatar
Kim_Busho
Icon for Nimbostratus rankNimbostratus
Feb 12, 2008

SSL/Tomcat Security Alert

We have a website that is hosted on Tomcat (v5.5) web servers and uses an SSL certificate configured on our (v9.1.2) F5's.     There is an iRule in place for the http vs that redirects all reque...
application delivery
dev
devops
iRules
dennypayne's avatar
dennypayne
Icon for Employee rankEmployee
Feb 14, 2008
To further elaborate on what KY is saying, most likely what is happening is that your Tomcat server is sending back http redirects to the client rather than https. Because you are decrypting SSL at the BIG-IP, the Tomcat server is running on port 80 and doesn't realize that it needs to send redirects as https instead of http.

 

 

The best way to fix this is to make sure your Tomcat server doesn't improperly send back http redirects, but if that is not possible, then you can use the Rewrite Redirects feature in the http profile on the BIG-IP to "catch" those http redirects on the way back out to the client and change them to https as they should be.

 

 

Click here for the manual on Rewrite Redirects for 9.1.2.

 

 

Denny