Forum Discussion

Deee-blue_14536's avatar
Deee-blue_14536
Icon for Nimbostratus rankNimbostratus
Mar 08, 2015

Client and server ssl cert location when redirecting to a second VIP (LTM)

Hi All,   I have a setup using a SAN cert which holds multiple URLs pointing to a single public IP address. I plan on having traffic hit a vip and then being filtered by url to a second tier of v...
application delivery
deployment
LTM
Michael_Jenkins's avatar
Michael_Jenkins
Icon for Cirrostratus rankCirrostratus
Mar 08, 2015

Since you're having multiple hosts go to the same VIP, you'll need to have the client cert (your SAN) on the primary VIP, so it can offload the SSL. You could also have the SAN cert on your secondary VIPs and a default cert as the serverssl cert on your primary VIP if you wanted to secure communication to the secondary VIPs (though since it's internal to the device, I don't think that it would matter since the traffic never leaves the BIG-IP between those two).

 

Regarding inheritance, the VIPs would be set up separately, so they'll each have their own iRules, profiles, etc... Basically they're configurations will be completely separate.