You have two options
1. (As you mentioned) Donot offload ssl on CSS and send the traffic to Server directly for ssl offload. Shortcoming of this method is that you cannot use HTTP headers for making Intelligent LB decisions
You simply need a content rule listening on TCP 443. For e.g
content apps-443
add service svc1
add service svc2
vip address 192.168.1.1
protocol tcp
port 443
active
service svc1
ip address 10.10.10.1
port 443
protocol tcp
keepalive type tcp
keepalive port 443
active
service svc2
ip address 10.10.10.2
port 443
protocol tcp
keepalive type tcp
keepalive port 443
active
2. Do end2end SSL. Where you will have to install cert on CSS, offload ssl on css, make LB decision based on Layer7 headers, encrypt the http request again and send it to the server as encrypted request (Server will do the SSL offloading again).
HTH
Syed Iftekhar Ahmed
