Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 

VIP using two different URL and certificates


I have a scenario that the server team is asking to create a VS in the F5 that will be used by an external application to access an internal application using API. But in the scenario, there are some points to be considered.


1) the external application will use a specific URL and certificate that will be configured in the F5 (VS Standard, Client SSL Profile and etc.)


2) the internal application is configured to use another URL and certificate


I will create a client SSL profile using the external certificate and a Server SSL Profile using the internal certificate.


In that case, I need to use an iRule to rewrite the HTTP Location on the HTTP header to match the same URL that is used by the internal application? I am not considering using a redirect.






Hi Thiago,


I understand that you have one external hostname for your app and one internal. In your example for external and for internal.

And that you have different paths for internal and external. External might be /dirA/index.html, while internal might be /dirB/index.html.

So for users accessing the app via you want to rewrite the HTTP::host and (partially) the HTTP:path so that they match the internal ones, right? That can be done with iRules or with LTM Traffic Policies. I find this picture handy to learn the terminology.


For the SSL bridging, 90% of the cases can be satisfied with the default serverssl profile, it is sufficient to establish a connection to a pool member using https. Unless you have requirements on the serverside, like SNI or SSL protocol, this serverssl profile will do.


Best of luck


Hi Daniel,


Thank you for your reply.


I got more details about the request that the application will handle.


External URL:

Internal URL:


In that case, I am thinking to use an iRule to rewrite the HTTP::host from to in the HTTP_REQUEST and HTTP_RESPONSE?


What do you think about it?




Hi Thiago,

I would use a LTM Traffic Policy instead on an iRule and also I would pay attention if maybe you want to rewrite the Referer header too.

In a Traffic Policy you would do it like this (tmsh output)

ltm policy { controls { forwarding server-ssl } requires { http } rules { { actions { 0 { http-host replace value } 1 { http-referer replace value "tcl:[regsub -nocase {} [HTTP::header Referer] {}]" } 2 { forward select pool } } conditions { 0 { http-host host values { } } } } status published strategy first-match }





Thanks, Daniel


The configuration is ready to be applied in the F5, after that, I'll let you know.

Hi Daniel


I don't know how, but the external application gets access to the internal application through the Virtual Server, but I don't have to configure police or iRule. The Virtual Server was configured to Standard type, SSL Client Profile was configured to use the external certificate, and SSL Server Profile was configured to use the internal certificate. When I applied all configurations in the F5, in the first test, the access was done successfully.

Hi Thiago,


it's not a big surprise, to be honest. Standard Virtual, client and server SSL profile. It usually works.

What specific cert and key you use for the server SSL profile is not critical in most cases, therefore it works with the internal cert. Most likely the default serverssl profile would work too.

Also most modern apps do not require to rewrite host header and referer header.

So it's the final question, who came up with the requirements to do so? 🙂

Not for finger-pointing, but for explaining and knowing better next time.