![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Anybody on here an expert with Big IP from F5 and SSL?
What we've got is a DNN instance hosting multiple portals on IIS 6. We want to have SSL enable for some of the portals. The DNN instance is behind a Big IP box. The problem is that IIS 6 only supports one cert per website in IIS (in IIS DNN appears to be on website). So we want to install the certs on the Big IP box. So the communication would look something like this:
Client <-----443-----> Big IP <-----80-----> IIS and DNN
In DNN you can mark a site as having SSL being installed, then mark a page as requiring SSL which means that page will generate a 302 redirect to the https version of the page if anybody tries to access the page via http.
The problem starts when the request comes into IIS and DNN generates the redirect - the new redirected page IIS is going to try and send back to the big IP box is going to be sent as encrypted, and since the cert doesn't live on the IIS box, the connection won't be able to be established between the IIS server and the Big IP box.
Does anybody have an experience with this? Any ideas on how to resolve it? The goals are this: Setup the Cert on the Big IP box, and still allow DNN to do the redirects. If I have to install a wildcard cert on the IIS box I can, but I don't want the end users to see anything but their basic URL - I'd also like it to be minimal maintenance if possible on both the Big IP and IIS boxes.
One thought I had was setup a wildcard (say *.securestuff.com) cert on the IIS box, then in Big IP setup an IRule that says when you see an HTTPS request - bolt on the extra to the domain... So an incoming request from the client is https://www.foo.com, and it get's sent to the IIS box as https://www.foo.com.securestuff.com (for example) which then responds and Big IP can then just pass the request back - but I don't want the client ever seeing the https://www.foo.com.securestuff.com url, just the https://www.foo.com.
Any Ideas?
Thanks in advance.
What we've got is a DNN instance hosting multiple portals on IIS 6. We want to have SSL enable for some of the portals. The DNN instance is behind a Big IP box. The problem is that IIS 6 only supports one cert per website in IIS (in IIS DNN appears to be on website). So we want to install the certs on the Big IP box. So the communication would look something like this:
Client <-----443-----> Big IP <-----80-----> IIS and DNN
In DNN you can mark a site as having SSL being installed, then mark a page as requiring SSL which means that page will generate a 302 redirect to the https version of the page if anybody tries to access the page via http.
The problem starts when the request comes into IIS and DNN generates the redirect - the new redirected page IIS is going to try and send back to the big IP box is going to be sent as encrypted, and since the cert doesn't live on the IIS box, the connection won't be able to be established between the IIS server and the Big IP box.
Does anybody have an experience with this? Any ideas on how to resolve it? The goals are this: Setup the Cert on the Big IP box, and still allow DNN to do the redirects. If I have to install a wildcard cert on the IIS box I can, but I don't want the end users to see anything but their basic URL - I'd also like it to be minimal maintenance if possible on both the Big IP and IIS boxes.
One thought I had was setup a wildcard (say *.securestuff.com) cert on the IIS box, then in Big IP setup an IRule that says when you see an HTTPS request - bolt on the extra to the domain... So an incoming request from the client is https://www.foo.com, and it get's sent to the IIS box as https://www.foo.com.securestuff.com (for example) which then responds and Big IP can then just pass the request back - but I don't want the client ever seeing the https://www.foo.com.securestuff.com url, just the https://www.foo.com.
Any Ideas?
Thanks in advance.