TLS Server Name Indication and Path Based Routing for a particular VIP

Hello, I think you should be able to run both iRules on same VIP wihout issues, since there's no overlap/conflict in their purpose.

Keep in mind instructions in HTTP_REQUEST event will always be performed before istructions in SERVER_CONNECTED event. This thread contains an excellent flowchart that shows in what order events are triggered. 

Thank you CA_Valli.

I put the iRule in place within the VIP. However I am still just presented with the 1 cert that is assigned with the sslclient profile of the VIP. I tried adding the second cert to the VIP however I received a warning/error msg : 0107149c:3: Virtual server /Common/xxxxxxx has more than one clientssl/serverssl profile but none of them is default for SNI. 

Am I supposed to have them both listed within the Virtual Server profile in order for the irule to be able to call them? 

when HTTP_REQUEST {
set hostname [getfield [HTTP::host] ":" 1]
}
when SERVER_CONNECTED {
switch -glob [string tolower $hostname] {
"*.client1.com" {
SSL::profile ssl-CLIENT1
}
"*.client2.local" {
SSL::profile ssl-CLIENT2
}
default {
#default serversssl profile to be selected if Host header value cannot be matched with predefined values
SSL::profile ssl-CLIENT1
}
}
}

Hi

F5 made documents relate to this situation

if you must need irule, you need configure sni check ssl profile 

https://community.f5.com/t5/technical-articles/sni-routing-with-big-ip/ta-p/282018

---

viziony wrote: ChoiceADVANTAGE

Would any know how I can incorporate these 2 iRules into one or can they be ran independently and both iRules are utilized on the same VIP? 

My scenario, if a connection comes in for a particular client we would like to present that client with a particular cert we have defined, once that check is completed the traffic would then proceed to path based routing irule.

Referring to this article for TLS SNI https://support.f5.com/csp/article/K13452

This code is for TLS SNI 

when HTTP_REQUEST {
    set hostname [getfield [HTTP::host] ":" 1]
}
when SERVER_CONNECTED {
    switch -glob [string tolower $hostname] {
    "siteA.com" {
        SSL::profile serverssl-siteA
    }
    "siteB.com" {
        SSL::profile serverssl-siteB
    }
  default {
#default serversssl profile to be selected if Host header value cannot be matched with predefined values
    SSL::profile serverssl
  }
}
}

AND

when HTTP_REQUEST {
switch -glob -- [string tolower [HTTP::uri]] {
"/test*" -
"/test2.php*" -
"/tt/*" -
"/aa/*" -
"*/example/*"  {
pool pool-A
}
default {
pool pool-B
}
}
}

 

 

---

I tried adding the second cert to the VIP however I received a warning/error msg : 0107149c:3: Virtual server /Common/xxxxxxx has more than one clientssl/serverssl profile but none of them is default for SNI.