configure SSL for virtual web

[julxu]

Is it possible to achive the following:

-myhost is a web server.

-myweb1 is a virtual web located on myhost, so, it is an DNS alias of myhost. it's SSL runs on the server myhost.

-myhost2 is another virtual web located on myhost and it is an DNS alias of myhost also. it has another key/cert and run SSL on the server myhost also.

I have been asked to configure SSL termination on my CSS11506 to offload the SSLs trafic.

Could anyone advice me for a VIP, (myhost), can I use two key/CA? if so, how do I configure them?

Any comments will be appreciated

Thanks in advance.

[Gilles Dufour · Accepted solution]

The problem is that a key/cert pair is associated with 1 domain only [or multiple domains if you have wildcard certificate - but it's obviously not the case here].

When the CSS receives the TCP SYN to initiate a new SSL connection, it does not know which domain, because 1 ip belongs to 3 domains.

Therefore the only solution to identify which domain it is [and therefore which key/cert to use], is to use a different TCP port for each domain.

myhost would use port 443

myweb1 would use port 444

myweb2 would use port 445

This is usually not very good because most of the time you never specify the port in your browser. So, you may type https://www.myweb1.com and end up at https://www.myhost.com because the default port is 443.

Since this is a new design I would strongly recommend to have 1 IP address per domain.

This is not a Cisco limitation but a TCP/IP behavior.

Gilles.

[julxu]

do you mean give myhost two vip? so:

myhost:

VIP 10.1.30.31 - dns name myhost1,dns alias myweb1

VIP 10.2.30.32 - dns name myhost2,dns alias myweb2

Many Regards

[julxu]

I have make two VIPs and they all use same service - the local server of myhost.

configured DNS as above. and after client send client hello, the VIP send res ack. (both sites)

Am I configure wrong? the configuration just looks same as others.

Any advice?

Thanks in advance.

[Gilles Dufour]

give us your full config.

If you are using 2 vip addresses, I don't see where is the problem.

Simply configure the 2vips, the 2 ssl-server and use the same service for the backend connection.

Gilles.

[julxu]

ssl-proxy-list ssl-slot3

ssl-server 31

............. -> the one which working fine.

ssl-server 14

ssl-server 14 vip address 10.1.31.14

ssl-server 14 cipher rsa-with-rc4-128-sha 10.11.31.14 81

ssl-server 14 rsakey Myweb1Rkey

ssl-server 14 rsacert Myweb1Scert

ssl-server 15

ssl-server 15 vip address 10.1.31.15

ssl-server 15 rsakey Myweb2Rkey

ssl-server 15 rsacert Myweb2Scert

ssl-server 15 cipher rsa-with-rc4-128-sha 10.11.31.15 81

active

service ssl-slot3-srv

type ssl-accel

keepalive type none

slot 3

add ssl-proxy-list ssl-slot3

active

service myhost

ip address 10.4.31.14

keepalive type tcp

keepalive port 80

active

owner mytest

content myweb2-rule

add service ssl-slot3-srv

vip address 10.1.31.15

protocol tcp

port 443

content myweb2-rule2

vip address 10.4.31.15

protocol tcp

port 81

balance leastconn

add service myhost

active

content myweb1-rule

protocol tcp

port 443

add service ssl-slot3-srv

vip address 10.1.31.14

active

Do I miss anything?

[julxu]

sorry, miss the last part:

content myweb1-rule2

port 81

protocol tcp

add service myweb1

balance leastconn

vip address 10.1.31.14

active

[julxu]

yes, it is working now.