Forum Discussion
CirrusTLS Server Name Indication and Path Based Routing for a particular VIP
CirrusThank you CA_Valli.
I put the iRule in place within the VIP. However I am still just presented with the 1 cert that is assigned with the sslclient profile of the VIP. I tried adding the second cert to the VIP however I received a warning/error msg : 0107149c:3: Virtual server /Common/xxxxxxx has more than one clientssl/serverssl profile but none of them is default for SNI.
Am I supposed to have them both listed within the Virtual Server profile in order for the irule to be able to call them?
when HTTP_REQUEST {
set hostname [getfield [HTTP::host] ":" 1]
}
when SERVER_CONNECTED {
switch -glob [string tolower $hostname] {
"*.client1.com" {
SSL::profile ssl-CLIENT1
}
"*.client2.local" {
SSL::profile ssl-CLIENT2
}
default {
#default serversssl profile to be selected if Host header value cannot be matched with predefined values
SSL::profile ssl-CLIENT1
}
}
}
CA_ValliMVP
Hi,
that would be correct, if you configure more than one SSL profile in virtual server you need to specify one and only one of them to be sni/default (the certificate Common Name will be presented to any SNI received which hasn't a best match with other profiles), and specify service name --which can be a wildcard match-- on all other profiles.
Also, I've just noticed you're referencing "client" profiles, however your iRule triggers on a Server-Side event (TCP connection on selected pool member). Do you need a specific certificate on client or server side?
Lastly .. if the iRule purpose is only to achieve SNI support, you should be able to configure it without requiring an iRule (also, it will be about 20% more efficient on performance). You just need to select the specific checkboxes in clientSSL/serverSSL profile list. Make sure all of the profiles you use support the same ciphers sets.
Check links below:
SNI support on clientSSL profiles (very likely what you're missing and why you see that error log)
Also, this whitepaper has some pretty good considerations, it helped me last year to achieve a similar scenario.
