NimbostratusHere is the existing setup. VIP and pool members listening on 443. Wild card certificate on the client ssl. In server profile "abc.com as server name.
Requirement:
One more URL to be added as "xyx.abc.com in the same vip. Certificate would be the same wild card.What should be the client and server ssl profile. Please help.
NacreousIf all works with
abc.com*.abc.comxyx.abc.comServerssl profile has no domain-aware significance. It is used to enable BigIP act as a SSL/TLS client so the traffic to Pool Member will be encrypted before it's forwarded downstream.
NimbostratusThe VIP works when i attach a server profile with server name abc.com . But not for xyz.abc.com
Employeeif i do not misremember, serverssl profile does not forward server name indicated from clientside to serverside. so, can you try something like this?
 
Modifying serverside SSL profile based on hostname for SNI (Kai Wilke's comment) https://devcentral.f5.com/s/feed/0D51T00006i7eN3SAI
 
NacreousNo server name should be specified in serverssl profile unless your external web address URLs do not match with listener configurations in web servers. If the web server is configured to listen on
abc.com:443xyx.abc.com:443
NimbostratusIf all works with
abc.com*.abc.comxyx.abc.comServerssl profile has no domain-aware significance. It is used to enable BigIP act as a SSL/TLS client so the traffic to Pool Member will be encrypted before it's forwarded downstream.
NimbostratusThe VIP works when i attach a server profile with server name abc.com . But not for xyz.abc.com
Employeeif i do not misremember, serverssl profile does not forward server name indicated from clientside to serverside. so, can you try something like this?
Modifying serverside SSL profile based on hostname for SNI (Kai Wilke's comment) https://devcentral.f5.com/questions/modifying-serverside-ssl-profile-based-on-hostname-for-sni-48452
NimbostratusNo server name should be specified in serverssl profile unless your external web address URLs do not match with listener configurations in web servers. If the web server is configured to listen on
abc.com:443xyx.abc.com:443