Serverside SNI injection iRule

Problem this snippet solves: Hi Folks, the iRule below can be used to inject a TLS SNI extension to the server side based on e.g. HOST-Header values. The iRule is usefull if your pool servers depe...
Updated Jun 06, 2023
Version 2.0
devops
security
server name indication injection
sni
sni injection
Kai_Wilke's avatar
Icon for MVP rankMVP
My name is Kai Wilke and I'm working as a Principal Consultant for IT-Security at itacs GmbH - a German consulting company specialized in Microsoft Security cloud solutions, F5 customizations as well as for classic IT-Consulting. You can find additional information about me and my work here: https://devcentral.f5.com/articles/q-a-with-itacs-gmbhs-kai-wilke-devcentrals-featured-member-for-february-24890
View Profile
JoeTheFifth's avatar
JoeTheFifth
Icon for Altostratus rankAltostratus
Jun 26, 2017

I was redirected from this thread (https://devcentral.f5.com/questions/help-with-sni-not-being-passed-to-pool-serverscomment50962) to this one by Stanislas. I was struggling with two certs/two profiles with SNI support. couldn't make it work. I just tested this irule and it works fine. I wanted to use the default config instead of an irule as I already have a complex irule/apm setup but this solves my issue for the moment. I had a question in mind about how to make it work with two certs but I answered my question with a quick test. I created a client profile (no sni setting defined) and added the two certs ( with only one key otherwise you get the error 'Client SSL profile cannot contain more than one set of same certificate/key type'). I created a server profile (no sni no cert just inherited from th default ssl server). Pluged the iRule to the VS and voilà ! :-) Cheers ! But I'd like to know if configuring multiple profiles with sni entries (and a default sni profile) on a single VS work !