Forum Discussion

Nate_Hershey_10's avatar
Nate_Hershey_10
Icon for Nimbostratus rankNimbostratus
Dec 11, 2008

HTTPS to HTTPS Redirect For Certificate Host Match

Hello,

 

 

We have moved from v4.x to v9.x and I'm having some trouble implementing a set of rules to force all traffic (HTTP and HTTPS) for a virtual server to redirect to https://www.domain.com/ unless the request already matches that URL. I've spent about a half hour looking through these forums and I can't seem to find anything that matches my situation exactly. Hopefully someone can help- I apologize if I missed a pertinent post in my search.

 

 

One of our web sites needs to receive all traffic over SSL and the request host needs to match the SSL cert hostname. We have a rule in place that redirects the traffic that comes in over HTTP successfully. Here's what we're using:

 

 

when HTTP_REQUEST {

 

HTTP::redirect "https://www.domain.com[HTTP::uri]"

 

}

 

 

This works great for users who request content via HTTP, but when a user makes a request to https://domain.com (leaving out the www.), they go straight to the site and get a message saying that the hostname on the cert doesn't match the request.

 

 

The site consists of 2 virtual servers from a Big-IP perspective- one listening on port 80 and one on port 443. How can we force the traffic that comes in over HTTPS to conform to the required hostname? Is it possible? Thanks in advance for any help.

 

 

-Nate

1 Reply

  • Colin is definitely accurate when he says you can't decrypt the SSL until you send the certificate, but you could get a cert which is valid for example.com and www.example.com (using Subject Alternate Names). This is pretty well supported in current browsers. Try searching for the forums for SAN for more details.

     

     

    Aaron