multiple SSL cert on 1 VIP question

Hi!

Sorry to say this, but you can't do this with two certificates. You need a multi certificate or a wildcard certificate to accomplish it.

Reason being that the information needed to determine which certificate to use is located at layer 7 while the ssl encryption is done before this.

Thus you can only use one certificate per IP+port.

/Patrik

With SNI the client provides the domain name prior to SSL handshake completion which allows the SSL application to choose a profile prior to completing the handshake. Perhaps this article can offer some additional background:

SOL13452: Configuring a virtual server to serve multiple HTTPS sites using TLS Server Name Indication feature

Hope this is helpful, Kevin

You have two Certs and one VIP. The way to fix this is either ask the CERT Provider like verisign, Thawte or whomever issued the CERT to combine two CERTS into one. If you view a CERT, click on Detail & find subject alternative names.. The CERT will then have both URL's (one with www and one without)... Or, you can do what I would do and add an iRule to virtual server to remove www & all will work. Here is the iRule.

when HTTP_REQUEST {
 Check if the host starts with www.
if {[string tolower [HTTP::host]] starts_with "www."}{
 Redirect with the www. prefix removed to the same URI
HTTP::redirect "http://[string range [HTTP::host] 4 end][HTTP::uri]"
   }
}