Loading...
Loading...
The BIG-IP system is unable to perform server-side SNI without using an iRule.
You must write an iRule that dynamically selects a server SSL profile based on the client host header.
-- Server-side pool members are configured to use TLS SNI. -- More than one valid server name exists.
None.
A new parameter has been added to the virtual server called 'serverssl-use-sni'. If multiple server SSL profiles are configured, and serverssl-use-sni is enabled, then the server SSL profile whose server-name matches the SNI extension in ClientHello will be selected. In the example below, server SSL profile s.1 will be used by default, unless the client connects using the SNI 'valid-client', in which case profile s.2 will be used. ltm profile server-ssl s.1 { app-service none cipher-group none ciphers ECDHE-RSA-AES128-SHA256 server-name none sni-default true } ltm profile server-ssl s.2 { app-service none cipher-group none ciphers DHE-RSA-AES256-GCM-SHA384 server-name valid-client session-ticket enabled } ltm virtual tls { destination 10.98.22.213:https ip-protocol tcp mask 255.255.255.255 pool ssl profiles { c.1 { context clientside } s.1 { context serverside } s.2 { context serverside } tcp { } } serverssl-use-sni enabled source 0.0.0.0/0 source-address-translation { type automap } }
Click on a version to see all relevant bugs
F5 Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.