Forum Discussion

Jair_Candia's avatar
Icon for Nimbostratus rankNimbostratus
Jun 29, 2022

Bypass Host


I have multiples websites hosted in same virtual server. But these websites are from differents domains; e.g. "" and ""

"" use letsencrypt for the certificates, so these changes every 3 months. When I redirect traffic to BigIP virtual server I can access "" but "" shows me SSL certificate warning and aint no able to access it, because it's getting the certificate. Both websites use https.

I need an iRule to bypass the traffic of, I tried with:

if { [HTTP::host] contains ""{
SSL::disable clientside
SSL::disable serverside
pool pool_10.0.1.1


But it does not work. Any idea?

2 Replies

  • Hello Jair_Candia

    If I'm interpreting te problem right, you have SSL issue due to SNI mismatch when you access service.

    My guess would be, your VS might be missing SSL configuration. I wanted to understand better if you have any restraints in importing certificate on F5 because this will make configuration easier. 

    For multiple SNI support you can configure a second clientSSL profile with explicit "" SNI (or wildcard equivalent) and make "" clientSSL profile default for all SNI. Of course, if certificate changes every three months you should remember to upload it on F5 every time. 

    If you need F5 to pass-through SSL for only, configuration is trickier. Easiest way, if possible, is to have different Virtual Servers - one with and one without SSL profiles.

    If they must coexist on same VS, you need to perform the SSL disable operations ar right time in traffic flow. HTTP_REQUEST event is too late since SSL handshake already happened. I believe your best bet would be CLIENT_ACCEPTED event - this is TCP handshake, but in this case you should write matching conditions based on TCP properties. Or, (I'm not sure about this), you might be able to disable SSL on CLIENTSSL_CLIENTHELLO event and in this case you should be able to match SNI. You should also disable serverSSL on matching serverside event.