Use different client-ssl depending on host name

Question

I am trying to save VIP addresses on our https servers. We have a webserver pool serving multiple hostnames. Unitl now for each https request we are setting up a new VIP corresponding with the client-ssl related to the host name. What I am looking for is something like if hostname matches website1.com use client-ssl website1if hostname matches website2.com use client-ssl website2etc ...Keep in mind that we are running version 12.1.3.Is there somewhere a possibility ?

mayur_sutare · Answer

Hello &nbsp;You can use multiple client SSL profiles on the VIP. So Depending on the hostname, the proper client certificate will get used. In order to use it, you need to enable SNI settings in one of the client SSL profile which will act as Default/Fallback SSL profile. This fallback SSL profile will get used when the server name doesn't match or the client is not supporting SNI. In other words, if server name is not macthing and/or client is not supporting SNI, then fallback SSL profile will served the SSL/TLS handshake.&nbsp;You can define one of the client SSL profile as a fallback SSL by checking below option under SSL profile advance settings.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Note : Unless you define one of the profile acting as default/fallback SSL profile for the VIP, you can't map multiple SSL profiles to single VIP.&nbsp;https://support.f5.com/csp/article/K13452 &nbsp;Hope it helps!Mayur Sutare&nbsp;

willy · Answer

Hello Mayur,I created a test setup with different certificates and used the server name field int the clientssl, and created one last clientssl as default. This did the trick. I even went further by using a policy to go to different pools depending the host name. That also went well. Many thank for your answer and help. &nbsp;

mayur_sutare · Answer

&nbsp;Great, happy to know that.

liefzimmerman · Answer

&nbsp;, I got your email about the broken links related to this elsewhere on our site. I will be getting those updated, where possible. You did the right thing by asking your question here.  was able to answer your question before I even woke up. 😉 CommunityFTW. Thanks for sharing.

Forum Discussion

SSO Login Update Coming to DevCentral

Kevin - June 2026 Featured F5er

Tyler - May 2026 Featured Member

Recent Discussions

F5 System Scanner - How I deployed it at scale

What configuration issue am I experiencing with this 130-domain VS ?

Ivanti MDM Core & F5 LTM/ASM with mTLS

F5 BIGIP & XC certbot plugin

Hardware BIG-IP appliance reach EOSS, but the software version running on it not yet?

Related Content

SSL Profiles Part 8: Client Authentication

SSL Client Certification Alert 46 Unknown CA

Client SSL Authentication on BIG-IP as in-depth as it can go

Thumbprint of the client ssl certificate

SSL Orchestrator Advanced Use Cases: Client Certificate Constrained Delegation (C3D) Support

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS