# SSL Orchestrator Use Case: Inbound SNI Switching with version 9.1 **URL:** \ **Category:** F5 Technical Articles\ **Tags:** ssl-orchestrator, series-ssl-orchestrator-advanced-use-cases, switch, security, sslo, sni\ **Created:** [January 6, 2022, 5:48pm UTC](https://community.f5.com/t/ssl-orchestrator-use-case-inbound-sni-switching-with-version-9-1/67566 "2022-01-06T17:48:18Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![KevinGallaugher](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevingallaugher/32/13108_2.png) [@KevinGallaugher](https://community.f5.com/u/KevinGallaugher)\ **Post date:** [January 6, 2022, 5:48pm UTC](https://community.f5.com/t/ssl-orchestrator-use-case-inbound-sni-switching-with-version-9-1/67566/1 "2022-01-06T17:48:18Z")
## Introduction SSLO will generate a single set of SSL profiles for use in a topology. It may be useful, especially in an inbound gateway mode, to process traffic to multiple sites, requiring different server certificates. The use case is to employ native BIG-IP SNI switching in SSLO, such that an SSLO topology can select a correct client SSL profile and server certificate based on the incoming SNI. In this example we have a single web server with multiple IP addresses hosting different web site domains: [en.appserverone.com](http://en.appserverone.com) resides on 10.1.10.90 [en.appservertwo.com](http://en.appservertwo.com) resides on 10.1.10.91 When an external client requests [https://en.appserverone.com](https://en.appserverone.com) we want the SSL Orchestrator to use a specific keypair for the sessions and direct the traffic to 10.1.10.90. When an external client requests [https://en.appservertwo.com](https://en.appservertwo.com) we want the SSL Orchestrator to use a different keypair for the sessions and direct the traffic to 10.1.10.91. ## Configuration Steps Import Private Keys and Certificates Create Client SSL Profiles Create New SSL Configurations Add the Client SSL Profiles to the Interception Rule ## Import the Private Key and Certificate for the different web site domains From the BIG-IP Configuration Utility go to SSL Orchestrator \> Certificates Management \> Certificates and Keys. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/7/f/7f8f6504c43853d772bb5be5ad462d4fd1f2b41d.png) Click Import on the right. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/1X/5341d672732a1766de45bebd4f85098c64cd3c95.png) For the Import Type select Key. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/a/a0bbdd27646b58a5b329d5554e2e51949997050a.png) Give it a name, [en.appserverone.com](http://en.appserverone.com) in this example. For the Key Source you can upload a file or paste in the text. We’ll use the Paste option which you can see below. Click Import when done. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/c/ce8bc0eab13d980a4a999946d2017cbe5f6c64bb.png) Click on the Key Name created in the previous step. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/f/f9b73b63f9ec65857eb6eca65729525c66f4a5ae.png) Click Import. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/1/1bc1eec38550a518e5fbaa0ecc891d716c63aa72.png) For the Certificate Source you can upload a file or paste in the text. We’ll use the Paste option which you can see below. Click Import when done. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/3/3359cbaf401eff9dc8ce8507b206dd2fde7d28d0.png) Repeat these steps for other web site domains. In this example we will add one more, [en.appservertwo.com](http://en.appservertwo.com) as you can see below. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/7/725b51420fbe62ca47507db56c8923edd931bd2a.png) ## Create a Client SSL Profile for each certificate/key pair From the BIG-IP Configuration Utility go to SSL Orchestrator \> Components \> Profiles \> Client SSL. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/1/1d0f9821eea71942e8b794b9a98fdd88205363c3.png) Click Create on the right. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/7/7da10516627228767d5f49baae28b1642a6820cb.png) Give it a name, [en.appserverone.com](http://en.appserverone.com) in this example. Select the Custom box on the far right then click Add for the Certificate Key Chain. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/1/193bf0a6837d2fafd80aad90d88f2b9fda847815.png) Select the Certificate and Key created previously and click Add. A Passphrase and Chain can be specified if needed. Click Add when done. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/6/6dc09c3bec715416cdd676c997cf1c211cd402f1.png) Select the Advanced option next to Configuration. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/1/1faf67fc78c669a2505c197eb5e7db4f2085c791.png) Scroll down and find the Server Name field. Enter the FQDN that external clients will request, [en.appserverone.com](http://en.appserverone.com) in this example. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/04b5c8f5bd28d12905b436dc4c0795906d255195.png) **Note: when an external client requests** [**https://en.appserverone.com**](https://en.appserverone.com) **their TLS Client Hello will contain an extension value for ‘server\_name’ field with a value of ‘[en.appserverone.com](http://en.appserverone.com)’. We’re instructing SSL Orchestrator to use this Client SSL Profile when it receives this type of request from a client.** Scroll to the bottom and click Finished when done. ![image_285590.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/d/dce5b6132ec15adb2c0ae26f7a30ce0b97b6237f.png) Repeat these steps for other web site domains. In this example we will add one more, [en.appservertwo.com](http://en.appservertwo.com) as you can see below. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/c/c47d594fe147a4f4adae58a395183aa014de05ad.png) ## Create New SSL Configurations In this example an Incoming L3 Topology already exists. From the Configuration Utility select SSL Orchestrator \> Configuration \> SSL Configurations. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/0a16ca97a6ff8641924dacae93fb91c21a461a94.png) Click Add ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/0/09004da6757a91cd53729e1c5cab2a7e4abc2996.png) Give it a name, appserverone in this example. Deselect the check boxes for Forward Proxy and Default SNI. For the SNI Server Name enter the FQDN, [en.appserverone.com](http://en.appserverone.com) in this example ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/2/288cdcab9f9b4f6e55235fc12eb97fae10d99a96.png) For Client-side SSL select the pencil icon to edit the Certificate Key Chains. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/3/3b919451c916e6162bcbce076efb7430a6832044.png) Use the Drop Down menu to choose the correct Certificate and Key, [en.appserverone.com](http://en.appserverone.com) in this example. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/1X/79c6dab5f0290b209a623fe1781aa31bde883814.png) Click Done ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/7/2/72134cd6df5647e7ab35c20664606c17b5bb5a16.png) Click Save & Next at the bottom. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/5/6/56912b39bf54f842d60ad5c7fb89b85692d69db9.png) Click Deploy ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/8/a/8a998810df3ccf6d65b805a91ba0d9954d1829ee.png) Click OK to the Success message ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/c/d/cdfbd1cb83713b05f43ec2bffee09c05429c20d1.png) Repeat this step as needed. In this example another SSL Configuration is added for [en.appservertwo.com](http://en.appservertwo.com). ## Add the Client SSL Profiles to the Interception Rule From the Configuration Utility select SSL Orchestrator \> Configuration \> Interceptions Rules. sslo\_L3\_inbound. Select the correct rule, sslo\_L3\_inbound in this example. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/b/b804d3d02b40505432929cb968d0250812344d21.png) Click the pencil icon to edit the rule. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/c/f/cf7ddf5670482866ffcf8c0cae201935db479b5e.png) Scroll down to the Server SSL Profiles. Select the Server SSL Profiles created previously and click the arrow to move them from Available to Selected. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/d/d22cf3e34c794320656ba4f6c114f4ad1a06813f.png) At the bottom click Save & Next. ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/5/6/56912b39bf54f842d60ad5c7fb89b85692d69db9.png) Click Deploy ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/2X/d/dcab113edb72f465eb3a4774a063b3d2b3e6bf4b.png) Click OK to the Success message ![image_285405.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/c/d/cdfbd1cb83713b05f43ec2bffee09c05429c20d1.png) ## Summary Congratulations! The configuration is now complete