# client not support ssl to ssl supported server

**URL:** <https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938>\
**Category:** Technical Forums\
**Tags:** application-delivery\
**Created:** [November 10, 2022, 1:05pm UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938 "2022-11-10T13:05:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lior](https://avatars.discourse-cdn.com/v4/letter/l/3ec8ea/32.png) [@lior](https://community.f5.com/u/lior)\
**Post date:** [November 10, 2022, 1:05pm UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938/1 "2022-11-10T13:05:27Z")

</div>

Hi all,

I have a condition that I have an application that needs to send api requests.  
and if it comes from a certen source ip I need to forward it to another pool.  
I cant do a redirect(302)..cause its api, I have to just send the traffic forward and it needs to be encrypted with ssl

I try to make it with Irule, I think I got that part that I rewrite the traffic but I cant make the use of ssl on the server side only

Irule -

when HTTP\_REQUEST {  
if {[IP::addr [IP::client\_addr] equals “10.10.10.10”]} {  
HTTP::header replace Host “xyz”  
pool another\_pool-443  
HTTP::uri “abcwq/”  
}  
}

---

<div class="post-metadata">

**Author:** ![CA\_Valli](https://avatars.discourse-cdn.com/v4/letter/c/9dc877/32.png) [@CA\_Valli](https://community.f5.com/u/CA_Valli)\
**Post date:** [November 10, 2022, 1:12pm UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938/2 "2022-11-10T13:12:52Z")

</div>

You should be able to achieve this with a serverSSL profile on your virtual server.

If only this very specific traffic needs encryption, you could add an “else” statement with **SSL::disable serverside** &nbsp;command in addition to serverSSL profile.. something like this

```tcl
when HTTP_REQUEST {
 set nossl 1
 if {[IP::addr [IP::client_addr] equals "10.10.10.10"]} {
  HTTP::header replace Host "xyz"
  pool another_pool-443
  HTTP::uri "abcwq/"
  set nossl 0
 }
}
when SERVER_CONNECTED {
  if {$nossl}{ SSL::disable } 
}

```

---

<div class="post-metadata">

**Author:** ![lior](https://avatars.discourse-cdn.com/v4/letter/l/3ec8ea/32.png) [@lior](https://community.f5.com/u/lior)\
**Post date:** [November 10, 2022, 1:31pm UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938/3 "2022-11-10T13:31:48Z")

</div>

I have configure the server ssl profile “serverssl” on the same vip that is configured with the I rule and it didnt work..

with wireshark I still see no ssl

---

<div class="post-metadata">

**Author:** ![CA\_Valli](https://avatars.discourse-cdn.com/v4/letter/c/9dc877/32.png) [@CA\_Valli](https://community.f5.com/u/CA_Valli)\
**Post date:** [November 10, 2022, 3:17pm UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938/4 "2022-11-10T15:17:37Z")

</div>

What is the full setup?

---

<div class="post-metadata">

**Author:** ![xuwen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/xuwen/32/13933_2.png) [@xuwen](https://community.f5.com/u/xuwen)\
**Post date:** [November 15, 2022, 1:54am UTC](https://community.f5.com/t/client-not-support-ssl-to-ssl-supported-server/70938/5 "2022-11-15T01:54:43Z")

</div>

firstly, configure the virtual server add a server ssl profile, the server ssl profile needs a cert and key

give your LTM configuration or screenshot(does LTM can ping pool members ip address?if LTM can ping, VS enable Automap,exclude network route problems ), list ltm virtual XXX. It is normal for us to test with bigip VE. At the same time, tcpdump is performed on the back-end server and in the LTM serverside direction to check out LTM whether send ClientHello packet in the serverside(when your back-end server performs https handshake whether want to force the ClientHello message to carry SNI fields?). Another point is that the URI in the normal format starts with “/”,