Forum Discussion

Sake_Blok's avatar
Sake_Blok
Icon for Nimbostratus rankNimbostratus
May 10, 2007

Providing an http-response after killing a serverside SSL connection

Hi, I'm building an iRule on a vip with serverside-ssl. The iRule must validate the common name in the server-certificate dynamically against the Host: header in the http-request. If the cn doe no...
application delivery
dev
devops
iRules
Deb_Allen_18's avatar
Deb_Allen_18
Historic F5 Account
May 11, 2007
Hi Sake --

You might try using "LB::detach" to close the server side of the connection without affecting the client side:
when HTTP_REQUEST {
   set hostname [HTTP::host]
}
when SERVERSSL_HANDSHAKE {
   set sslcert [SSL::cert 0]
   set cn [findstr [X509::subject $sslcert] "CN=" 3]
   if { $cn ne $hostname } {
      LB::detach
      log local0. "Server-side connection closed: $cn != $hostname"
      HTTP::respond 200 content "blah"
   }
}
HTH

/deb