Forum Discussion

Gerardo_Garcia_'s avatar
Gerardo_Garcia_
Icon for Nimbostratus rankNimbostratus
Dec 13, 2006

SSL Certificates

I have few vritual servers

 

www.virtual1.com IP1

 

www.virtual2.com IP2

 

www.virtual3.com IP3

 

 

All of them are connected to the same pool of servers

 

pool with member1 and member2

 

 

Our application requires SSL on the server side but when we load the SSL on the server (read 443)

 

 

virtual2 and virtual3 send the nasty error message that the secure connection is with virtual1

 

 

Is there any way to remove the SSL from the servers and send the SSL certificate from BIG IP once the user is connected?

 

 

Please comment!.

 

 

PS: when I access https://www.virtual1.com I need to see the port 443 in the server side or my application won't work.

 

 

Thanks!

 

application delivery
dev
devops
iRules

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 14, 2006
    I don't understand why clients connecting to www.virtual2.com would get an error for a certificate on www.virtual1.com. Is the application sending back absolute references to www.virtual1.com's hostname or IP address?

     

     

    Can you provide more detail on the exact connections that are being made and when the client is getting an error? If you want to get a more detail on what the client is receiving, try using LiveHttpHeaders for Firefox or IEwatch or HTTPwatch for IE to view the headers and data being sent to the client.

     

     

    Aaron
  • Gerardo_Garcia_'s avatar
    Gerardo_Garcia_
    Icon for Nimbostratus rankNimbostratus
    Dec 14, 2006
    My current problem is that the application needs to terminate SSL on the servers.

     

    If don't have that the application does not work.

     

     

    Let's put it in this way we need to terminate SSL on the servers.

     

    If we load the SSL certificates then we cannot have several virtual[1,2,3..].com without the secuirty pop up window in the browser window.

     

    We are not talking about multiples extensions of the same domain (*.mydomain.com), we are talking about different domains.

     

    virtual1.com

     

    virtual2.com

     

    virtual3.com

     

    In addition, Our application needs the X-Forward header.

     

     

    We need to send the certificate from the BIG IP to the servers.

     

     

     

    Please comment!

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 14, 2006
    Okay... so you don't need an iRule for this. You can configure a client SSL profile using each of the SSL certifiates/keys, for each virtual server. This will allow you to decrypt the client to virtual server SSL.

     

     

    You can then configure a single server SSL profile and associated that profile with each of the virtual servers. This will allow BIG-IP to re-encrypt traffic from itself as the client to the servers in the pool.

     

     

    To insert the X-Forwarded-For header, just enable the option on a new HTTP profile and associate that with the virtual server.

     

     

    As this doesn't pertain to rules, please read up on these configuration steps in the 9.x Configuration Guide for your version on AskF5.com. If you have any questions, you can contact F5 support.

     

     

    Thanks,

     

    Aaron