Forum Discussion

FrancisP_219227's avatar
FrancisP_219227
Icon for Nimbostratus rankNimbostratus
Aug 27, 2015

SSL Offload port 443 to port 80

I have two webservers. Tested the website locally on Port 80. Website is working properly

 

example:

 

Created an F5 VS will SSL offload. Certificate loaded properly. Assigned a DNS friendly name which is the same as the CN of the certificate (cn=mydomain.com)

 

https://mydomain.com (works fine and display the default website). So I know the VS and certs are working.

 

https://mydomain.com/webapp1 is not working. Should it work straight-away or do I need a iRule to replace the host/url::uri??

 

Please help. Urgent work

 

3 Replies

  • Assuming VS and pool setup correctly should work straight away, I'd check the webserver logs first.

     

  • Many backends will require some type of indication the HTTPS offloading has occurred. One common way is to use an X-Forwarded-Proto: https header.

     

  • Can you please elaborate on how it's not working?

     

    There are a great number of things that applications can do badly in the presence of a proxy server. Sometimes it's an easy fix with the X-Forwarded-Proto header, but more often than not the applications simply don't understand the proxy environment and the original developers used absolute URLs in HTTP redirects and payload content. There's certainly a way to make it work, but you need to understand why it isn't working before you can attempt to fix it.

     

    Please do the following and let us know what you find:

     

    1. Look for any documentation on this application that talks about proxied environments. It could be as simple as inserting an XFP header letting the server know the proxy is there.

       

    2. Fire up a client side inspection tool like Fiddler or HTTPWatch and observe the HTTP traffic from the browser's perspective. If the application is acting badly behind the proxy, you'll most likely see the browser receive absolute URLs, or simply http:// URLs from the server, and then try and fail to follow these.