Forum Discussion

Felix_29330's avatar
Felix_29330
Icon for Nimbostratus rankNimbostratus
Oct 28, 2010

Unexpected: Big-IP Redirecting Connection from SSL to HTTP

Hi All,

 

 

I have a Big-IP appliance sitting in front of 2 servers for load-balancing and SSL-offloading.

 

 

My problem is that when a user accesses the virtual server URL with httpS, the browser opens the page with the URL changed to HTTP. Which implies the connection from the end-user browser to the servers is no longer encrypted.

 

 

I have gone through the appropriate VS settings and all seems to be fine.

 

 

To give more info:

 

 

I have installed the appropriate certificate/key files, created an SSL client profile and referenced that SSL client profile in my Virtual Server configuration which is listening on port 443.

 

 

The connection between the Big-IP and the real servers is however clear text HTTP.

 

 

I would appreciate any assistance on fixing this problem.

 

 

Thanks. Felix

 

 

 

 

config
design
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Oct 28, 2010
    Are the links in the content being returned by your server http or https? If http, you might try to enable secure links in your app, or use a stream profile to rewrite them in the response. Make sure you enable chunking in the http profile if you take the latter approach.
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Nov 09, 2010
    Felix: this is a common issue. Here's the high-level idea of what is going on - your web servers are unaware that there is an upstream device doing SSL proxying. It's common for applications to build self-referencing redirects, which they will build based on their specific application configuration/context. So to the servers, they're normal old HTTP, so they'll redirect that way. Alternatively, as Jason mentions it's possible that there are hard-coded or dynamically generated references to http:// in the actual content being served.

     

     

    For this issue, there are a few things to try. First, I'd take an HTTPWatch capture so you can see what is going on. If the server is issuing redirects via HTTP, it'll drive the solution one way. If the content has hard-coded references, it'll drive it another (Jason's stream profile, above).

     

     

    -- If you're redirecting, look at setting up a custom HTTP profile, where you've got 'redirect rewrite' enabled and set to matching. Note that you may need a combination of this *and* a stream profile to change the content.

     

    -- In many cases, you can configure your app server to be aware of an upstream proxy. For example, in Tomcat there's a server.xml setting called "ProxyPort" that will ensure that tomcat-built redirects are sent to the appropriate port.

     

     

    Good luck, and if you can please post and update.

     

    -Matt