Multiple Irule association based on SNI

[Shazee]

Hi All,

I have a query

Think of a scenario where  SNI is configured ( to have ABC.com and DEF.com serving from the same Virtual server).

We will call the Virtual server as SNI-VS.

ABC.com and DEF.com have 2 different sets of Certificates. (Signed by different CAs). So 2 diff Client SSL profiles.

I have an extra irule (An iRule that extracts client certificate details and inserts them into HTTP headers ) which is attached to virtual server  SNI-VS (which is going to serve both the URLs stated above).

I want this extra Irule to kick in only when ABC.com traffic is processed and I need a different irule (not the one mentioned above) to kick in when DEF.com traffic is processed.

Is there a way to do this? Could you please share some F5 docs with which I can achieve this? 

is it possible to have 2 different Irule for the same virtual server which is configured for SNI.

[xuwen]

use this code try it,here is the link about the irules for SSL::sni, https://clouddocs.f5.com/api/irules/SSL__sni.html

when HTTP_REQUEST {

if { [SSL::cert count] > 0 && [SSL::verify_result] == 0} {

if { [SSL::sni name] equals "ABC.com" } {

HTTP::header insert SSLClientCertSN [X509::serial_number [SSL::cert 0]]

}

}

}