CSS Internal server initiate in clear text then encrypt to host

[markjwalmsley]

Hi

This may be difficult to explain but I will try.

I have numerous HTTPS clients coming into a VIP, hitting a 443 content rule on port 443, hit the SSL module etc then they are load balanced to one of three servers on port 81. Now, say one of the 3 servers has to initiate a seperate connection to the host it's currently talking to but from a different port, say 8080 from the server and I want it to talk SSL back to the same host on 443, is this possible? When the host replies on 443, won't there be some confusion when it hits the 443 content rule, ssl module, because of the port 81 services configured?

The only examples that seem to come close is back end server initiation but It seems that you have to specify an ip address, I would not have any way of specifying an ip ass it could be any one of a few hundred clients.

Can anyone help?

Sorry if this is difficult to understand and please ask me to clarify if necessary.

Thanks for your help.

Kind regards

Mark.

[Gilles Dufour]

if the application requires a connection to be open back to the client, can't you setup the application to use SSL instead of HTTP ?

Indeed, the only option is SSL Initiation, but it requires to know the destination address.

Telling you this will not probably help you but I'd like to say that this kind of application opening a connection from the server to the client is very weird.

What if, like most client it is behind a firewall or running the integrated windows firewall ? the firewall will most probably block the connection from your server.

Can't you design the application differently and let the client open a 2nd connection with the server in HTTPS ?

Gilles.

[markjwalmsley]

Thanks Giles,

Many people have said that this is weird. It seems like it's an afterthought as much of the work for this project was finished some time ago then this request suddenly popped up. I think you're right and I'm going to question this and try to get the app re-written which is probably what they are trying to avoid anyway.

Cheers.

Mark.