Forum Discussion

Ryan_34424's avatar
Icon for Altostratus rankAltostratus
Jun 05, 2017

APM :: Portal Access Lists :: SNI & HTTP

I'm trying to create a Portal Access List with a few web resources, and one of the links does not work because it is an Apache server that is validating that the SNI and HTTP hostname match. The problem is, that when the user logs into APM and launches the web link, they are launching a request to the APM and not the backend server... therefore the SNI is for APM and does not match the HTTP hostname in the header (which is specified in the Portal Access link via Application URI).

[ssl:error] [pid 11111] AH02032: Hostname provided via SNI and hostname provided via HTTP are different

From what I've read, this cannot be disabled on the Apache server without removing SNI and recompiling... which is not an option for me. However this F5 use-case seems like it would be fairly common, so I'm not sure what I'm missing here.

Anybody have any thoughts?


1 Reply

  • Use this Irule


        Set the SNI value (e.g. HTTP::host)
        set sni_value [getfield [HTTP::host] ":" 1]
         SNI extension record as defined in RFC 3546/3.1
         - TLS Extension Type                =  int16( 0 = SNI ) 
         - TLS Extension Length              =  int16( $sni_length + 5 byte )
            - SNI Record Length              =  int16( $sni_length + 3 byte)
               - SNI Record Type             =   int8( 0 = HOST )
                  - SNI Record Value Length  =  int16( $sni_length )
                  - SNI Record Value         =    str( $sni_value )
         Calculate the length of the SNI value, Compute the SNI Record / TLS extension fields and add the result to the SERVERSSL_CLIENTHELLO 
        SSL::extensions insert [binary format SSScSa* 0 [expr { [set sni_length [string length $sni_value]] + 5 }] [expr { $sni_length + 3 }] 0 $sni_length $sni_value]

    This is the Kai wilke code with host name from rewritten hostname instead of portal hostname