Multiple SSL terminations - 1 CSS11506

Well the questions keep coming.
Can anyone point me in the right direction for setting up multiple SSL terminations, 443 port for them all and multiple VIPS. So far I have one SSL site working but when i try to make my 2nd ssl proxy list active it says only one active at a time. So looking for sample configs to make this happen.
Cheers
Dave

Thanks man, I read up a bit more and figured that out..Here is my config so far...
ssl associate rsakey myrsakey1 CSSrsakey1
ssl associate cert myrsacert1 CSScertfile1
ssl associate rsakey myrsakey2 CSSrsakey2
ssl associate cert myrsacert2 CSScertfile2
ip route 0.0.0.0 0.0.0.0 192.168.20.1 1
!************************** CIRCUIT **************************
circuit VLAN1
ip address 192.168.20.20 255.255.255.0
!*********************** SSL PROXY LIST ***********************
ssl-proxy-list ssl-list
ssl-server 90
ssl-server 90 vip address 192.168.20.100
ssl-server 90 cipher rsa-with-des-cbc-sha 192.168.20.50 80
ssl-server 90 cipher rsa-with-3des-ede-cbc-sha 192.168.20.50 80
ssl-server 90 cipher rsa-with-rc4-128-sha 192.168.20.50 80
ssl-server 90 cipher rsa-with-rc4-128-md5 192.168.20.50 80
ssl-server 90 rsacert myrsacert1
ssl-server 90 rsakey myrsakey1
ssl-server 90 urlrewrite 22 www.test.com
ssl-server 91
ssl-server 91 vip address 192.168.20.101
ssl-server 91 cipher rsa-with-des-cbc-sha 192.168.20.60 80
ssl-server 91 cipher rsa-with-3des-ede-cbc-sha 192.168.20.60 80
ssl-server 91 cipher rsa-with-rc4-128-sha 192.168.20.60 80
ssl-server 91 cipher rsa-with-rc4-128-md5 192.168.20.60 80
ssl-server 91 rsacert myrsacert2
ssl-server 91 rsakey myrsakey2
ssl-server 91 urlrewrite 23 www.test1.com
active
!************************** SERVICE **************************
service SSLWWW
type ssl-accel
slot 6
keepalive type none
add ssl-proxy-list ssl-list
active
service rprox1
ip address 192.168.20.50
protocol tcp
port 80
active
service rprox2
ip address 192.168.20.60
protocol tcp
port 80
active
!*************************** OWNER ***************************
owner CMPA
content HTTP_rule
protocol tcp
add service rprox1
port 80
url "//www.test.com/*"
vip address 192.168.20.100
content SSLrule2
protocol tcp
vip address 192.168.20.101
application ssl
add service SSLWWW
port 443
active
content ssl
vip address 192.168.20.100
application ssl
add service SSLWWW
port 443
protocol tcp
active

Similar Messages

  • ACE - SSL Termination is not working

    HTTPS is not working from official IE browser but it is working from test Firefox browser. However HTTP is working with both IE and Firefox browsers. This is true for multiple implementations on the ACE service module with SSL termination.
    ACE software 3.0(0)A1(4a)
    IE v6 SP3 Cipher 128
    Firefox v3.6.3
    Sample configuration:
    access-list FT ethertype permit bpdu
    access-list ALL-ACCESS extended permit icmp any any
    access-list ALL-ACCESS extended permit ip any any
    crypto chaingroup ROOT-CERT
      cert abc.PEM
      cert xyz.PEM
    parameter-map type ssl SSL-PARAMETER-1
      cipher RSA_WITH_RC4_128_MD5
      cipher RSA_WITH_RC4_128_SHA
      cipher RSA_WITH_AES_128_CBC_SHA priority 2
      cipher RSA_WITH_AES_256_CBC_SHA
      cipher RSA_EXPORT1024_WITH_DES_CBC_SHA
    parameter-map type ssl SSL-PARAMETER-2
      cipher RSA_WITH_AES_128_CBC_SHA priority 2
    ssl-proxy service SSL-1
      key KEY-1.PEM
      cert CERT-1.PEM
      chaingroup ROOT-CERT
      ssl advanced-options SSL-PARAMETER-1
    ssl-proxy service SSL-2
      key KEY-1.PEM
      cert CERT-1.PEM
      chaingroup ROOT-CERT
      ssl advanced-options SSL-PARAMETER-2
    ssl-proxy service SSL-3
      key KEY-1.PEM
      cert CERT-1.PEM
      chaingroup ROOT-CERT
    rserver host server1
      ip address 10.100.15.89
      inservice
    rserver host server2
      ip address 10.100.15.121
      inservice
    probe http PROBE-1
      interval 30
      faildetect 2
      request method get url /keepalive.htm
      expect status 200 200
    serverfarm host SERVERFARM-1
      probe PROBE-1
      rserver server1 80
        inservice
      rserver server2 80
        inservice
    sticky ip-netmask 255.255.255.255 address both STICKY-1
      timeout 30
      replicate sticky
      serverfarm SERVERFARM-1
    class-map type management match-any REMOTE-ACCESS
      match protocol icmp any
      match protocol snmp any
      match protocol ssh any
      match protocol https any
    class-map match-all VIP-1
      match virtual-address 10.100.15.140 tcp eq https
    class-map match-all VIP-2
    match virtual-address 10.100.15.140 tcp eq www
    policy-map type management first-match REMOTE-ACCESS
      class REMOTE-ACCESS
        permit
    policy-map type loadbalance first-match POLICY-1
      class class-default
        sticky-serverfarm STICKY-1
    policy-map multi-match LB-1
      class VIP-1
        loadbalance vip inservice
        loadbalance vip icmp-reply active
        loadbalance policy POLICY-1   
        ssl-proxy server SSL-1
    (i have tried with ssl-proxy server SSL-2 and ssl-proxy server SSL-3 but did not helP)
    policy-map multi-match LB-2
      class VIP-2
        loadbalance vip inservice
        loadbalance vip icmp-reply active
        loadbalance policy POLICY-1
    interface vlan 15
      description client vlan
      bridge-group 15
      mac-sticky enable
      access-group input FT
      access-group input ALL-ACCESS
      access-group output ALL-ACCESS
      service-policy input REMOTE-ACCESS
      service-policy input LB-1
      service-policy input LB-2
      no shutdown
    interface vlan 2015
      description server vlan
      bridge-group 15
      mac-sticky enable
      access-group input FT
      access-group input ALL-ACCESS
      access-group output ALL-ACCESS
      service-policy input REMOTE-ACCESS
      no shutdown
    interface bvi 15
      description bridge group
      ip address 10.100.15.5 255.255.255.0
      peer ip address 10.100.15.6 255.255.255.0
      alias 10.100.15.4 255.255.255.0 
      no shutdown
    ip route 0.0.0.0 0.0.0.0 10.100.15.1
    note: Subnet, Server Name, Certificate Name and Key Name are modified for security reason.

    Hello,
    We will not be able to determine why your SSL terminated connections fail with only your config.  You may want to take a look at a similar thread where someone else was having problems with IE and SSL termination, but Firefox worked fine.  It also includes a solid action plan you can use to gather data needed to diagnose root cause.  That thread can be viewed at the following link:
    https://supportforums.cisco.com/thread/2025417?tstart=0
    Also, the ACE software you are running is extremely old now and very buggy.  I would strongly urge you to upgrade to A2(2.4) as soon as possible.  It will help you avoid some headaches as you move forward.
    Hope this helps,
    Sean

  • CSS11500 - SSL termination

    I have a client that will not use my domain in connectivity to an application I am hosting.  They want to add an entry in thier DNS using thier domain, but resolve it to an address that I have configured as a VIP on my CSS.  I am terminating SSL for this particular VIP and have multiple clients already connecting to this same VIP.  Since I can't associate multiple certificates with a single VIP I was wondering is there a way that I can give this one client a seperate VIP and terminate the client certificate on my CSS and then rewrite the host header to look like my domain and hit the same VIP that all my other clients are hitting with the rewritten url.
    So the client will input https://www.abc.com and it will resolve to 174.10.10.1 (VIP).  The CSS will decrypt the SSL change the header to https://xyz.net which will resolve to 174.10.20.1 (leveraged VIP that all my other clients hit).
    If the url rewrite won't work could I use the SSL initiate commands to make this work.  My goal is to allow the client to use thier own domain in thier browser, but when it hits my backend servers it has to be from my hosted domain.

    Good afternoon,
    I'm not sure to understand why you need to rewrite the host header or send the request back to the other VIP.
    Since you are doing SSL termination, the backend connection (the one between the CSS and the server) will be using HTTP, so, the domain name would not have any impact.
    What you should do is create a new SSL termination VIP and map it to the same HTTP content rule or server.
    Don't hesitate to contact me again if you need further explanation on this.
    Regards
    Daniel

  • ACE 4700 configuring SSL termination weblogic server 10.3.6

    Hello,
    Im trying to configure an ACE 4700 so that SSL termination is done on the ACE and HTTP reaches the weblogic server instance.
    I have a working setup of a Apache reverse proxy doing SSL offloading and using a weblogic module and that works fine
    Was reading http://docs.oracle.com/cd/E23943_01/web.1111/e13709/load_balancing.htm#i1045186
    Can anyone point me to a working config example for doing this with the ACE4700 or give me some directions here?
    Kind regards,
    Laurens

    Hi Laurens,
    Here is a basic configuration for SSL termination:
    rserver host test
      ip address 10.198.16.98
      inservice
    rserver host test2
      ip address 10.198.16.93
      inservice
    serverfarm host test
      rserver test 80
        inservice
      rserver test2 80
        inservice
    ssl-proxy service TEST
      key cert
      cert cert
    class-map match-all VIPSSL
      2 match virtual-address 10.198.16.122 tcp eq https
    policy-map type loadbalance first-match test
      class class-default
        serverfarm test
    policy-map multi-match clients
      class VIPSSL
        loadbalance vip inservice
        loadbalance policy test
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 112
        ssl-proxy server TEST
    interface vlan 112
      ip address 10.198.16.91 255.255.255.192
      access-group input Allow_Access
      nat-pool 1 10.198.16.122 10.198.16.122 netmask 255.255.255.192 pat
      service-policy input NSS_MGMT
      service-policy input clients
      no shutdown
    Cesar R
    ANS Team

  • Configuring JMS and loadbalancer with SSL termination? Has Anyone done it?

    Hi all,
    I'm having a problem getting JMS or even any JNDI lookup to work with a hardware load balancer and SSL termination. Has anyone used such a configuration? The load balancer in question is a Cisco CSS 11500 Series which has an SSL module. A client communicates with the CSS over SSL, the SSL module decrypts the packets and sends it for content switching and on to WebLogic as cleartext.
    Without SSL termination everthing works fine. With SSL termination active, Web service and web content all work fine, but I can't get SSL tGetting Initial context from ms01
    <29-Sep-2006 16:07:22 o'clock IST> <Debug> <TLS> <000000> <SSL/Domestic license found>
    <29-Sep-2006 16:07:22 o'clock IST> <Debug> <TLS> <000000> <Not in server, Certicom SSL license found>
    <29-Sep-2006 16:07:23 o'clock IST> <Debug> <TLS> <000000> <SSL Session TTL :90000>
    <29-Sep-2006 16:07:23 o'clock IST> <Debug> <TLS> <000000> <Trusted CA keystore: D:/eclipse/workspace/LoadBalancerTest/ssl/keystores/cssKeyS
    ore.keystore>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <Filtering JSSE SSLSocket>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLIOContextTable.addContext(ctx): 886220>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLSocket will NOT be Muxing>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <write SSL_20_RECORD>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <3941240 received HANDSHAKE>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHello>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <3941240 received HANDSHAKE>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Certificate>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <validationCallback: validateErr = 0>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> < cert[0] = [
    Version: V3
    Subject: EMAILADDRESS="[email protected] ", CN=10.51.0.200, OU=Web Administration, O=Revenue Commissioners, L=Dublin, ST=Dublin,
    =IE
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
    Key: SunJSSE RSA public key:
    public exponent:
    010001
    modulus:
    a8f60248 b87c5860 229b9044 a666a9ae 27eb488c 424d9e67 e7b9d6d0 c292f081
    cfa76c04 f3d89b28 1bf544f9 5de2b66d 576ebeca 5dc5ca8a fceead9a 52e2ce6c
    2b91afef e4da5071 49b8784c 12d7f5f3 99f76482 79efe1d8 0a24f664 4c8d6e9e
    b0bc63be 1faf8319 eeb23e8a 019b65b2 59dd086d 1b714d4c 01618804 66f416bb
    Validity: [From: Fri Sep 08 11:44:28 BST 2006,
                   To: Mon Sep 05 11:44:28 BST 2016]
    Issuer: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    SerialNumber: [    0131]
    Certificate Extensions: 4
    [1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false
    Extension unknown: DER encoded OCTET string =
    0000: 04 1F 16 1D 4F 70 65 6E 53 53 4C 20 47 65 6E 65 ....OpenSSL Gene
    0010: 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 74 rated Certificat
    0020: 65 e
    [2]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: 0E 6E 72 2E B1 3B B6 A3 59 79 5A C5 41 26 B7 B6 .nr..;..YyZ.A&..
    0010: A2 39 4C 73 .9Ls
    [3]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE]
    SerialNumber: [    00]
    [4]: ObjectId: 2.5.29.19 Criticality=false
    BasicConstraints:[
    CA:false
    PathLen: undefined
    Algorithm: [MD5withRSA]
    Signature:
    0000: 2C A0 0C 34 4E 0D CA 24 A5 C3 03 3A 71 A1 2D D3 ,..4N..$...:q.-.
    0010: 65 A2 FA EF C1 5D D4 4A 28 8C 1A 70 5F 92 73 5E e....].J(..p_.s^
    0020: 7B 13 D4 AE 36 A8 86 EA 60 7F A5 E3 86 6E 84 1F ....6...`....n..
    0030: 5E 5F 30 06 B4 AA 2E 5C A7 65 74 32 09 0A 91 14 ^_0....\.et2....
    ]>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> < cert[1] = [
    Version: V3
    Subject: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
    Key: SunJSSE RSA public key:
    public exponent:
    010001
    modulus:
    bc61b29f a830c97a 7a76883e 1665a241 a68b891f 8e4167eb 62e578ac 9e342c3e
    53c9de8b e756634b e364010f 4d36c1c5 21a65b37 b64b4861 6f4dda29 b932191f
    Validity: [From: Mon May 31 15:22:15 BST 2004,
                   To: Thu May 29 15:22:15 BST 2014]
    Issuer: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    SerialNumber: [    00]
    Certificate Extensions: 3
    [1]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [2]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE]
    SerialNumber: [    00]
    [3]: ObjectId: 2.5.29.19 Criticality=true
    BasicConstraints:[
    CA:true
    PathLen:2147483647
    Algorithm: [MD5withRSA]
    Signature:
    0000: 3C 64 7C 9E 0B 90 48 9D 70 74 06 80 7F 2C AF 73 <d....H.pt...,.s
    0010: 92 1C C3 39 DD C3 45 B6 A4 8E 11 27 8E 21 18 4B ...9..E....'.!.K
    0020: FD AA 31 5E 35 FC DF 9E 70 42 F4 65 5C DF 56 9A ..1^5...pB.e\.V.
    0030: DD 8C 6B B7 3B BE E5 A7 D5 4A 16 23 C1 91 07 CA ..k.;....J.#....
    ]>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <SSLTrustValidator returns: 0>
    <29-Sep-2006 16:07:24 o'clock IST> <Debug> <TLS> <000000> <Trust status (0): NONE>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <Performing hostname validation checks: 10.51.0.200>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 received HANDSHAKE>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHelloDone>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 134>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <write CHANGE_CIPHER_SPEC, offset = 0, length = 1>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 16>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 received CHANGE_CIPHER_SPEC>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3941240 received HANDSHAKE>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Finished>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 272>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <3445873 read(offset=0, length=2048)>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3941240 received APPLICATION_DATA: databufferLen 0, contentLength 372>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3445873 read databufferLen 372>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3445873 read A returns 372>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 339>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3445873 read(offset=372, length=1676)>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <Filtering JSSE SSLSocket>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLIOContextTable.addContext(ctx): 6771926>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLSocket will NOT be Muxing>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 93>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 SSL3/TLS MAC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 received HANDSHAKE>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHello>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 SSL3/TLS MAC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 received CHANGE_CIPHER_SPEC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 SSL3/TLS MAC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 received HANDSHAKE>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Finished>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write CHANGE_CIPHER_SPEC, offset = 0, length = 1>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 16>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 402>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 1707>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <23328673 read(offset=0, length=2048)>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 SSL3/TLS MAC>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <3840954 received APPLICATION_DATA: databufferLen 0, contentLength 174>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <23328673 read databufferLen 174>
    <29-Sep-2006 16:07:29 o'clock IST> <Debug> <TLS> <000000> <23328673 read A returns 174>
    <29-Sep-2006 16:07:44 o'clock IST> <Debug> <TLS> <000000> <NEW ALERT with Severity: WARNING, Type: 0
    java.lang.Exception: New alert stack
    at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.closeWriteHandler(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.close(Unknown Source)
    at javax.net.ssl.impl.SSLSocketImpl.close(Unknown Source)
    at weblogic.net.http.HttpClient.closeServer(HttpClient.java:466)
    at weblogic.net.http.KeepAliveCache$1.run(KeepAliveCache.java:120)
    at java.util.TimerThread.mainLoop(Unknown Source)
    at java.util.TimerThread.run(Unknown Source)
    >
    <29-Sep-2006 16:07:44 o'clock IST> <Debug> <TLS> <000000> <avalable(): 23328673 : 0 + 0 = 0>
    <29-Sep-2006 16:07:44 o'clock IST> <Debug> <TLS> <000000> <write ALERT, offset = 0, length = 2>
    <29-Sep-2006 16:07:44 o'clock IST> <Debug> <TLS> <000000> <SSLIOContextTable.removeContext(ctx): 6771926>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <3941240 SSL3/TLS MAC>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <3941240 received APPLICATION_DATA: databufferLen 0, contentLength 98>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <3445873 read databufferLen 98>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <3445873 read A returns 98>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <Filtering JSSE SSLSocket>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLIOContextTable.addContext(ctx): 8406772>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLSocket will NOT be Muxing>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 93>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 SSL3/TLS MAC>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 received HANDSHAKE>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHello>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 SSL3/TLS MAC>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 received CHANGE_CIPHER_SPEC>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 SSL3/TLS MAC>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <21830977 received HANDSHAKE>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Finished>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <write CHANGE_CIPHER_SPEC, offset = 0, length = 1>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 16>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 339>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <5618579 read(offset=0, length=2048)>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:08:13 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    Exception in thread "main" javax.naming.CommunicationException [Root exception is java.net.ConnectException: https://10.51.0.200:8143: Boot
    trap to: 10.51.0.200/10.51.0.200:8143' over: 'https' got an error or timed out]
    at weblogic.jndi.internal.ExceptionTranslator.toNamingException(ExceptionTranslator.java:47)
    at weblogic.jndi.WLInitialContextFactoryDelegate.toNamingException(WLInitialContextFactoryDelegate.java:636)
    at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialContextFactoryDelegate.java:306)
    at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialContextFactoryDelegate.java:239)
    at weblogic.jndi.WLInitialContextFactory.getInitialContext(WLInitialContextFactory.java:135)
    at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
    at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
    at javax.naming.InitialContext.init(Unknown Source)
    at javax.naming.InitialContext.<init>(Unknown Source)
    at TestAllManagedServers.main(TestAllManagedServers.java:54)
    Caused by: java.net.ConnectException: https://10.51.0.200:8143: Bootstrap to: 10.51.0.200/10.51.0.200:8143' over: 'https' got an error or t
    med out
    at weblogic.rjvm.RJVMFinder.findOrCreate(RJVMFinder.java:200)
    at weblogic.rjvm.ServerURL.findOrCreateRJVM(ServerURL.java:125)
    at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialContextFactoryDelegate.java:296)
    ... 7 more
    o work for a simple JNDI lookup. With SSL debugging turned on, the following output is given:
    When I compare the Server HTTP logs I see that an initial context lookup involves 3 HTTP requests, e.g.
    25.2.1.210 - - [29/Sep/2006:16:29:12 +0100] "GET /bea_wls_internal/HTTPClntLogin/a.tun?wl-login=https+dummy+WLREQS+8.1.5+dummy+%0A&r
    and=3018901804201457976&AS=255&HL=19 HTTP/1.1" 200 17
    25.2.1.210 - - [29/Sep/2006:16:29:12 +0100] "GET /bea_wls_internal/HTTPClntRecv/a.tun?connectionID=0&rand=7332722597180897050 HTTP/1
    .1" 200 2341
    25.2.1.210 - - [29/Sep/2006:16:29:12 +0100] "POST /bea_wls_internal/HTTPClntSend/a.tun?connectionID=0&rand=3415396992694182025 HTTP/
    1.1" 200 17
    When my request goes through the load balancer I see the following in the HTTP logs:
    10.51.0.200 - - [29/Sep/2006:16:31:33 +0100] "GET /bea_wls_internal/HTTPClntLogin/a.tun?wl-login=https+dummy+WLREQS+8.1.5+dummy+%0A&
    rand=8279752507152372405&AS=255&HL=19 HTTP/1.1" 200 17
    10.51.0.200 - - [29/Sep/2006:16:31:33 +0100] "POST /bea_wls_internal/HTTPClntSend/a.tun?connectionID=0&rand=1051450669479197885 HTTP
    /1.1" 200 17
    10.51.0.200 - - [29/Sep/2006:16:32:28 +0100] "GET /bea_wls_internal/HTTPClntRecv/a.tun?connectionID=0&rand=6035654607615870287 HTTP/
    1.1" 200 5
    10.51.0.200 - - [29/Sep/2006:16:33:13 +0100] "GET /bea_wls_internal/HTTPClntRecv/a.tun?connectionID=0&rand=8245112057388607005 HTTP/
    1.1" 200 5
    Notice the time delay in some of the messages.
    The following error appears in the WebLogic server log, however I've verified that all IP addresses referenced by the load balancer configuration match those in the WebLogic configuration:
    <29-Sep-2006 16:31:43 o'clock IST> <Error> <RJVM> <BEA-000572> <The server rejected a connection attempt JVMMessage from: '266014296
    868812899C:25.2.1.210R:2462711729186814398S:10.51.0.2:[8113,8113,8114,8114,8113,8114,-1,0,0]:10.51.0.1:8103,10.51.0.1:8105,10.51.0.1
    :8107,10.51.0.2:8109,10.51.0.2:8111,10.51.0.2:8113:risIntCluster01:ms06' to: '0S:10.51.0.200:[-1,-1,-1,8143,-1,-1,-1,-1,-1]' cmd: 'C
    MD_IDENTIFY_REQUEST', QOS: '102', responseId: '0', invokableId: '0', flags: 'JVMIDs Sent, TX Context Not Sent', abbrev offset: '228'
    probably due to an incorrect firewall configuration or admin command.>
    When a JNDI lookup is made directly to a WebLogic server on the https port, the client gives the following output:
    Getting Initial context from ms01
    <29-Sep-2006 16:29:22 o'clock IST> <Debug> <TLS> <000000> <SSL/Domestic license found>
    <29-Sep-2006 16:29:22 o'clock IST> <Debug> <TLS> <000000> <Not in server, Certicom SSL license found>
    <29-Sep-2006 16:29:23 o'clock IST> <Debug> <TLS> <000000> <SSL Session TTL :90000>
    <29-Sep-2006 16:29:23 o'clock IST> <Debug> <TLS> <000000> <Trusted CA keystore: D:/eclipse/workspace/LoadBalancerTest/ssl/keystores/cssKeySt
    ore.keystore>
    <29-Sep-2006 16:29:23 o'clock IST> <Debug> <TLS> <000000> <Filtering JSSE SSLSocket>
    <29-Sep-2006 16:29:23 o'clock IST> <Debug> <TLS> <000000> <SSLIOContextTable.addContext(ctx): 7860099>
    <29-Sep-2006 16:29:23 o'clock IST> <Debug> <TLS> <000000> <SSLSocket will NOT be Muxing>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <write SSL_20_RECORD>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <32915800 received HANDSHAKE>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHello>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <32915800 received HANDSHAKE>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Certificate>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <validationCallback: validateErr = 0>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> < cert[0] = [
    Version: V3
    Subject: CN=10.52.0.3, OU=Revenue Integration Server, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
    Key: SunJSSE RSA public key:
    public exponent:
    010001
    modulus:
    ac47cae5 45e55fe4 8ec06362 84aab923 af35d7f1 8b7e8aaa 32772d8a d8185106
    0ba91363 07162207 6eaa33b4 db8a3fbb 1e228e93 841ff322 e319242a 04ae7447
    Validity: [From: Mon May 31 16:45:21 BST 2004,
                   To: Thu May 29 16:45:21 BST 2014]
    Issuer: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    SerialNumber: [    05]
    Certificate Extensions: 4
    [1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false
    Extension unknown: DER encoded OCTET string =
    0000: 04 1F 16 1D 4F 70 65 6E 53 53 4C 20 47 65 6E 65 ....OpenSSL Gene
    0010: 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 74 rated Certificat
    0020: 65 e
    [2]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: D7 B3 92 7B C7 4E 2F 5D F3 97 CB 3B F9 FB 0A 1E .....N/]...;....
    0010: 97 C5 DD F1 ....
    [3]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE]
    SerialNumber: [    00]
    [4]: ObjectId: 2.5.29.19 Criticality=false
    BasicConstraints:[
    CA:false
    PathLen: undefined
    Algorithm: [MD5withRSA]
    Signature:
    0000: 57 B6 54 4E 1A 54 91 66 5C A8 FE AF B6 50 AB 23 W.TN.T.f\....P.#
    0010: 6A 32 42 77 06 44 D5 7D 40 81 E4 DD 84 E3 7B 55 [email protected]
    0020: 96 A6 BC E9 E9 51 96 B9 E4 01 56 F9 41 B7 0C C3 .....Q....V.A...
    0030: 0A 92 C0 17 6E 6B 9D D6 9A 87 6D 6E 15 5A 86 F4 ....nk....mn.Z..
    ]>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> < cert[1] = [
    Version: V3
    Subject: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
    Key: SunJSSE RSA public key:
    public exponent:
    010001
    modulus:
    bc61b29f a830c97a 7a76883e 1665a241 a68b891f 8e4167eb 62e578ac 9e342c3e
    53c9de8b e756634b e364010f 4d36c1c5 21a65b37 b64b4861 6f4dda29 b932191f
    Validity: [From: Mon May 31 15:22:15 BST 2004,
                   To: Thu May 29 15:22:15 BST 2014]
    Issuer: CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE
    SerialNumber: [    00]
    Certificate Extensions: 3
    [1]: ObjectId: 2.5.29.14 Criticality=false
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [2]: ObjectId: 2.5.29.35 Criticality=false
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: D2 66 DD FC 06 C2 BC 7E 18 D5 64 38 AD 6E D0 0A .f........d8.n..
    0010: AA 97 05 0D ....
    [CN=Revenue CA, OU=Revenue Certificate Authority, O=Office Of The Revenue Commissioners, L=Dublin, ST=Dublin, C=IE]
    SerialNumber: [    00]
    [3]: ObjectId: 2.5.29.19 Criticality=true
    BasicConstraints:[
    CA:true
    PathLen:2147483647
    Algorithm: [MD5withRSA]
    Signature:
    0000: 3C 64 7C 9E 0B 90 48 9D 70 74 06 80 7F 2C AF 73 <d....H.pt...,.s
    0010: 92 1C C3 39 DD C3 45 B6 A4 8E 11 27 8E 21 18 4B ...9..E....'.!.K
    0020: FD AA 31 5E 35 FC DF 9E 70 42 F4 65 5C DF 56 9A ..1^5...pB.e\.V.
    0030: DD 8C 6B B7 3B BE E5 A7 D5 4A 16 23 C1 91 07 CA ..k.;....J.#....
    ]>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <SSLTrustValidator returns: 0>
    <29-Sep-2006 16:29:24 o'clock IST> <Debug> <TLS> <000000> <Trust status (0): NONE>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <Performing hostname validation checks: 10.51.0.1>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 received HANDSHAKE>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: ServerHelloDone>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 70>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <write CHANGE_CIPHER_SPEC, offset = 0, length = 1>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <write HANDSHAKE, offset = 0, length = 16>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 received CHANGE_CIPHER_SPEC>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 received HANDSHAKE>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <HANDSHAKEMESSAGE: Finished>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 0>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <write APPLICATION_DATA, offset = 0, length = 270>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <30340343 read(offset=0, length=2048)>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <isMuxerActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <SSLFilter.isActivated: false>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TLS> <000000> <32915800 SSL3/TLS MAC>
    <29-Sep-2006 16:29:28 o'clock IST> <Debug> <TL

    You will need an AAM set with the internal (http) address.
    http://blogs.msdn.com/b/ajithas/archive/2009/09/11/alternate-access-mapping-in-reverse-proxy-configuration.aspx
    Dimitri Ayrapetov (MCSE: SharePoint)

  • CSS/SSL termination - cypher negotiation Q

    Hi everyone
    question regarding SSL termination on CSS/SSL module.
    I have several several cyphers in my ssl-proxy list,
    What is the algorithm to choose the cypher ?
    I may assume that CSS and browser negotiate it during SSL session establishing.
    The testing shows that same browser gets different cyphers when it hits
    different CSSs (cyphers are in the same order in proxy-lists on CSSs)
    Thanks
    Alex

    Alex,
    it's not really an algorithm.
    The browser selects the first cipher that matches its requirements in the list presented by the server/CSS.
    The CSS builds a list in the order of weight.
    If you did not specify any weight, the list can be random depending in which order you entered the command.
    I would say, if you want a specific cipher to be selected, use a highest weight for this cipher.
    Gilles.

  • ACE SSL Terminator doesn't work

    Hi,
    I should implement a balancing HTTP and for HTTPS an  SSL terminator on my ACE.
    Public IP 22.235.121.6 port 80 --> balanced on 192.168.250.165-166 on port 8889
    Public IP 22.235.121.6 port 443 --> my ace terminate ssl and balance the traffic in clear text to 192.168.250.165-166 on port 8889
    This is the configuration:
    probe http EXAMPLE_IT_HTTP
    port 8889
    interval 5
    faildetect 2
    passdetect interval 10
    passdetect count 2
    request method get url /probe/probe.html
    expect status 200 206
    expect status 300 307
    open 1
    serverfarm host example_IT_HTTP
    failaction reassign across-interface
    predictor leastconns
    probe example_IT_HTTP
    fail-on-all
    rserver H-192.168.250.165 8889
    inservice
    rserver H-192.168.250.166 8889
    inservice
    serverfarm host example_IT_HTTPS-HTTP
    failaction reassign across-interface
    predictor leastconns
    probe example_IT_HTTP
    fail-on-all
    rserver H-192.168.250.165 8889
    inservice
    rserver H-192.168.250.166 8889
    inservice
    sticky ip-netmask 255.255.255.255 address both example-IT-HTTPS-HTTP
    timeout 60
    replicate sticky
    serverfarm example_IT_HTTPS-HTTP
    ssl-proxy service SSL_example_IT
    key example_it.key
    cert example_it.cert
    chaingroup SSL_CHAIN_example_IT
    crypto chaingroup SSL_CHAIN_example_IT
    cert example_it.ca
    class-map match-all example_IT_HTTP
    2 match virtual-address 22.235.121.6 tcp eq www
    class-map match-all example_IT_HTTPS-HTTP
    2 match virtual-address 22.235.121.6 tcp eq www
    policy-map type loadbalance first-match example_IT_HTTP-l7slb
    class class-default
    serverfarm example_IT_HTTP
    policy-map type loadbalance first-match example_IT_HTTPS-HTTP-l7slb
    class class-default
    sticky-serverfarm example-IT-HTTPS-HTTP
    policy-map multi-match int41
    class example_IT_HTTP
    loadbalance vip inservice
    loadbalance policy example_IT_HTTP-l7slb
    loadbalance vip icmp-reply active primary-inservice
    class example_IT_HTTPS-HTTP
    loadbalance vip inservice
    loadbalance policy example_IT_HTTPS-HTTP-l7slb
    loadbalance vip icmp-reply active primary-inservice
    ssl-proxy server SSL_example_IT
    the balancing on http work properly, but doesn't work the ssl termination, when I try to connect from my client in https I don't see request on the server 192.168.250.165-166 coming.
    Some show:
    balancer# sh crypto certificate all
    example_it.cert:
    Subject: /C=GB/ST=United Kingdom/L=London/O=XXXXXXXX/OU=XXXXXXXXX/CN=*.xxxx.com
    Issuer: /C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
    Not Before: Apr 11 00:00:00 2014 GMT
    Not After: Apr 12 23:59:59 2015 GMT
    CA Cert: FALSE
    example_it.ca:
    Subject: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
    Not Before: Nov  8 00:00:00 2006 GMT
    Not After: Jul 16 23:59:59 2036 GMT
    CA Cert: TRUE
    balancer# sh crypto session
    SSL Session Cache Stats for Context
    Number of Client Sessions: 0
    Number of Server Sessions: 0
    balancer#
    balancer# sh crypto files
    Filename File File Expor Key/
    Size Type table Cert
    cisco-sample-cert 1082 PEM Yes CERT
    cisco-sample-key 887 PEM Yes KEY
    example_it.ca 7444 PEM Yes CERT
    example_it.cert 1812 PEM Yes CERT
    example_it.key 1675 PEM Yes KEY
    balancer#
    balancer# crypto verify example_it.key example_it.cert
    Keypair in example_it.key matches certificate in example_it.cert.
    balancer#
    the show stats crypto client/server give me all 0
    Someone can help me to understand why is not working ?
    for further information please ask me
    Thanks a lot

    Hi,
    The problem is here:
    class-map match-all example_IT_HTTPS-HTTP
      2 match virtual-address 22.235.121.6 tcp eq www
    You should change it to 443 instead of WWW which means port 80.
    You will never match this class "example_IT_HTTPS-HTTP".
    Regards,
    Kanwal
    Note: Please mark answers if they are helpful.

  • OWA CSS11501 and ssl termination

    Hi,
    Is it possible to use the css to load balance for OWA and offload SSL ?
    have tried this and it appears to break OWA even though other web apps work ok through same CSS.
    When removing ssl termination could only make load balancing work when incoming tcp port on the content rule and outgoing tcp port to OWA server were set to 80.
    If content rule port was set to anyhting other than 80, OWA breaks.
    guess there is some form of embedded redirection going on.

    owa is sending a 302 of the form
    http://servername.
    because we are doing ssl offload on the css the redirect needs to be of the https://servername
    We followed some guides for configuring exchange to do this but it did not seem to work.

  • Hosting Multiple SSL Sites on Separate IP Addresses

    Hosting Multiple SSL Sites on Separate IP Addresses
    I currently have a web server (XServe) hosting a number of different sites from its main IP address on port 80 using Apache 1.3. This has been working great, the ServerAdmin GUI has been pretty good about creating the appropriate Apache configs, and everybody is happy.
    I have one particular site that I want to use SSL with so I decided to purchase a cert (from GoDaddy). Since I have one other cert on the server assigned to the main server IP, I understand that the appropriate way to setup additional SSL certificates is to bind another IP address to the XServe and use that IP. I was unable to use ServerAdmin to install my new certificate (not surprisingly) probably since it is a chain certificate, however I have been able to do it by hand and it seems to be working as intended…mostly.
    This is where my problem begins. The site that I wanted to add SSL to is currently hosted on the main IP address (x.x.x.173:80) and the SSL certificate is working on the newly bound IP address (x.x.x.178:443). Fundamentally it would seem appropriate to change the IP address of the non-SSL site to match the new IP, except on port 80 – So I can achieve a seamless blend between standard and SSL (when necessary). The problem is that I can’t get Apache to work this way. Maybe I am missing a step, or overlooking something.
    Excerpt from current, working (non-SSL) config: (Names have been changed to protect the innocent.)
    <VirtualHost x.x.x.173:80>
    ServerName www.site.com
    ServerAdmin [email protected]
    DocumentRoot "/Library/WebServer/Documents/www.site.com"
    </VirtualHost>
    Excerpt from current, working (SSL) config:
    <VirtualHost x.x.x.178:443>
    ServerName www.site.com
    ServerAdmin [email protected]
    DocumentRoot "/Library/WebServer/Documents/www.site.com"
    </VirtualHost>
    changing the first entry’s ip address to match the second one causes the site to be unresponsive (using the IP address to point the browser to the site) but the SSL version keeps working. Any suggestions would be greatly appreciated.
    Thanks,
    Jake
    PowerBook, XServe G5   Mac OS X (10.4.6)  

    Thanks for your reply Roger, here are the results that you’ve requested:
    I deleted a few lines that were redundant and unrelated (no errors)
    Results of apachectl configtest:
    Processing config directory: /etc/httpd/sites/*.conf
    Processing config file: /etc/httpd/sites/0012x.x.x.173_80www.site.com.conf
    Processing config file: /etc/httpd/sites/0016x.x.x.178_443www.site.com.conf
    Processing config file: /etc/httpd/sites/virtualhostglobal.conf
    [Thu Apr 6 09:06:27 2006] [warn] module mod_php4.c is already added, skipping
    Syntax OK
    Results from netstat -a -n | egrep 178:
    tcp4 0 0 x.x.x.178.53 . LISTEN
    udp4 0 0 x.x.x.178.123 .
    udp4 0 0 x.x.x.178.53 .
    Results from tail -f /var/log/httpd/error_log
    /etc/httpd/sites/0012x.x.x.173_80www.site.com.conf
    Processing gonfig file:
    /etc/httpd/sites/0016x.x.x.178_443www.site.com.conf
    Processing config file: /etc/httpd/sites/virtualhostglobal.conf
    [Thu Apr 6 09:21:10 2006] [warn] module mod_php4.c is already added, skipping
    [Thu Apr 6 09:21:10 2006] [notice] Apache/1.3.33 (Darwin) PHP/4.3.11 mod_ssl/2.8.24 OpenSSL/0.9.7i configured -- resuming normal operations
    [Thu Apr 6 09:21:10 2006] [notice] Accept mutex: flock (Default: flock)
    When I try to hit the site on port 80 http://x.x.x.178 there are no results, https://x.x.x.178 works great.
    Thanks again for your help, hopefully this can shed some light on my problem,
    Jake
    PowerBook, XServe G5 Mac OS X (10.4.6)
    PowerBook Mac OS X (10.4.6)

  • Apache reverse proxy and SSL termination

    Hi Guru's
        Can anyone tell me, how to do SSL termination at apache reverse proxy. I am using apache reverse proxy for accesing portal from internet. Apache is configured for SSL and portal is NON SSL.
    I am using header variable login module in portal. i wanted to terminate SSL at apache reverse proxy and then all traffic after that should be clear text.
    should i maitain any property. is there any documentation for it.
    Please help me
    Tom

    The majority of the work here is around configuring your Web Dispatcher and Apache Reverse proxy. The work on the portal is straight forward enabling of SSL.
    You can follow http://help.sap.com/saphelp_nw2004s/helpdata/en/f1/2de3be0382df45a398d3f9fb86a36a/frameset.htm for setting this up.
    what level I need to configure SSL and how do I proceed in both scenarios?
    Your question itself says where you need SSL. SSL is required where ever you need HTTPS communication.
    how do I proceed in both scenarios?
    From a portal perspective, the configuration should remain the same.
    Do I have to install SSL at portal, web dispatcher or at Apache level?
    SSL needs to be configured at all the 3 levels if you are looking at end to end SSL implementation.
    See the following for possible SSL implementation options:
    http://help.sap.com/saphelp_nw04/helpdata/en/d8/a922d7f45f11d5996e00508b5d5211/frameset.htm
    https://cw.sdn.sap.com/cw/docs/DOC-115509
    Will SSL termination work for scenario 2?
    Yes this should work - see http://help.sap.com/saphelp_nw2004s/helpdata/en/36/fd39eacf4cde4a8fe32d7f29b3db16/frameset.htm
    However in case of SSL Termination, the request to your portal from the web dispatcher will be sent as HTTP.
    I would recommend you to take a step by step (backward approach).
    First, enable SSL on your portal and make sure it works - going directly to the server.
    Then, you can introduce the Web Dispatcher - and test if every thing works going through the web dispatcher.
    Finally - you can test the end to end flow - with your Reverse proxy involved.
    - Shanti

  • SSL termination and URL redirection

    Hi All,
    I have configured application in cisco ACE module for which i got more requirement for URL redirection.
    Application setup is as below.
    VIP : 10.232.92.x/24 which is pointing to 2 Web server 10.232.94.x/24 range. In addition to that app team want APP server also need to be loadbalanced hence new VIP is configured for 10.232.92.x/24 which is pointing to 2 different app server 10.232.94.x/24.
    Both Web and App servers are having different IP but in same broadcastdomain. SSL termination is done on ACE.
    Issue : 1) After initiating connection i am getting login page but after login its again giveing login page. After 2 to 3 trial its giving me application page but with invalid session error.
    2) How to do https connection redirecting to different path.
    Ex. https://apps.xyz.com to https://apps.xyz.com/abc
    configuration :
    probe tcp rem_app_tcp
      port 2100
      interval 5
      passdetect interval 10
      passdetect count 2
      open 1
    probe http rem_itsm_https
      port 80
      interval 5
      passdetect interval 10
      passdetect count 2
      request method get url /keepalive/https.html
      expect status 200 200
      open 1
    serverfarm host app_tcp
      predictor leastconns
      probe rem_app_tcp
      rserver server1 2100
        inservice
      rserver server2 2100
        inservice
    serverfarm host rem_https
      predictor leastconns
      probe rem_itsm_https
      rserver server3 80
        inservice
      rserver server4 80
        inservice
    action-list type modify http remurlrewrite
      ssl url rewrite location "apps\.xyz\.com"
    policy-map type loadbalance first-match app_tcp
      class class-default
        serverfarm app_tcp
    policy-map type loadbalance first-match app_https
      class class-default
        serverfarm rem_https
        action remurlrewrite
    class-map match-all VIP_rem_app_tcp
      2 match virtual-address 10.232.92.8 any
    class-map match-all VIP_rem_itsm_https
      2 match virtual-address 10.232.92.9 tcp eq https
    class-map match-all real_servers_vlan273
      2 match source-address 10.232.94.0 255.255.255.0
    policy-map multi-match VIPS
      class real_servers_vlan273
        nat dynamic 1 vlan 273
      class VIP_rem_app_tcp
        loadbalance vip inservice
        loadbalance policy rem_app_tcp
        loadbalance vip icmp-reply
      class VIP_rem_itsm_https
        loadbalance vip inservice
        loadbalance policy rem_itsm_https
        loadbalance vip icmp-reply
        ssl-proxy server Remedy-SSL-PROXY

    Hi Kanwaljeet,
    I have applied below config for HTTPS URL redirection. Seems it dint work for me. Redirect serverfarm and policy map was not hitted.
    access-list ANY line 8 extended permit ip any any
    probe tcp rem_app_tcp
      port 2100
      interval 5
      passdetect interval 10
      passdetect count 2
      open 1
    probe http rem_itsm_https
      port 80
      interval 5
      passdetect interval 10
      passdetect count 2
      request method get url /keepalive/https.html
      expect status 200 200
      open 1
    ip domain-name nls.jlrint.com
    ip name-server 10.226.0.10
    ip name-server 10.226.128.10
    rserver redirect REDIRECT-TO-HTTPS
      webhost-redirection https://%h/arsys 301
      inservice
    rserver host serv1
      ip address 10.232.94.74
      inservice
    rserver host serv2
      ip address 10.232.94.75
      inservice
    rserver host serv3
      ip address 10.232.94.76
      inservice
    rserver host serv4
      ip address 10.232.94.77
      inservice
    serverfarm redirect REDIRECT-SERVERFARM
      predictor leastconns
      rserver REDIRECT-TO-HTTPS
        inservice
    serverfarm host rem_app_tcp
      predictor leastconns
      probe rem_app_tcp
      rserver serv1 2100
        inservice
      rserver serv2 2100
        inservice
    serverfarm host rem_itsm_https
      predictor leastconns
      probe rem_itsm_https
      rserver serv3 80
        inservice
      rserver serv4 80
        inservice
    ssl-proxy service Remedy-SSL-PROXY
      key Remkey.pem
      cert Remcert.pem
    class-map type management match-any MANAGEMENT_CLASS
      3 match protocol ssh any
      4 match protocol snmp any
      5 match protocol icmp any
      6 match protocol http any
      7 match protocol https any
    class-map match-all VIP_rem_app_tcp
      2 match virtual-address 10.232.92.8 any
    class-map match-all VIP_rem_itsm_http
      2 match virtual-address 10.232.92.9 tcp eq www
    class-map match-all VIP_rem_itsm_https
      2 match virtual-address 10.232.92.9 tcp eq https
    class-map match-all real_servers_vlan273
      2 match source-address 10.232.94.0 255.255.255.0
    policy-map type management first-match MANAGEMENT_POLICY
      class MANAGEMENT_CLASS
        permit
    policy-map type loadbalance first-match REDIRECT-PM
      class class-default
        serverfarm REDIRECT-SERVERFARM
    policy-map type loadbalance first-match rem_app_tcp
      class class-default
        serverfarm rem_app_tcp
    policy-map type loadbalance first-match rem_itsm_https
      class class-default
        serverfarm rem_itsm_https
    policy-map multi-match VIPS
      class real_servers_vlan273
        nat dynamic 1 vlan 273
      class VIP_rem_itsm_http
        loadbalance vip inservice
        loadbalance policy REDIRECT-PM
      class VIP_rem_itsm_https
        loadbalance vip inservice
        loadbalance policy rem_itsm_https
        loadbalance vip icmp-reply
        ssl-proxy server Remedy-SSL-PROXY
      class VIP_rem_app_tcp
        loadbalance vip inservice
        loadbalance policy rem_app_tcp
        loadbalance vip icmp-reply
    interface vlan 270
      description VIP
      ip address 10.232.92.4 255.255.255.0
      alias 10.232.92.6 255.255.255.0
      peer ip address 10.232.92.5 255.255.255.0
      access-group input ANY
      service-policy input MANAGEMENT_POLICY
      service-policy input VIPS
      no shutdown
    interface vlan 273
      description Real server
      ip address 10.232.94.66 255.255.255.192
      alias 10.232.94.65 255.255.255.192
      peer ip address 10.232.94.67 255.255.255.192
      access-group input ANY
      nat-pool 1 10.232.92.253 10.232.92.253 netmask 255.255.255.0 pat
      service-policy input MANAGEMENT_POLICY
      service-policy input VIPS
      no shutdown

  • SSL Termination not working in ACE

    Hi,
    The context was configured for Load Balancing Port 80 and 443 traffic before the SSL Configs was Applied.
    The SSL Termination is configured on ACE module running the software version  A2(1.6a) [build 3.0(0)A2(1.6a)
    The load balacing is working without no issues, But when i do a https://abc.www.abc.qa/wps/portal/login
    the browser reconganizes the certificate from ACE, but does not show up any thing, just shows  this symbol € 
    in a blank page.
    Plese let me know if you have any suggestions.
    Thanks in Advance.
    Here is the relevant config.
    ===================
    crypto csr-params ABC-II-PRAMS
      country XX
      state XXXX
      locality XXXX
      organization-name abc council
      common-name abc.www.abc.qa
      serial-number 1
      email [email protected]
    rserver host abcserver1
      ip address 10.14.1.165
      inservice
    rserver host abcserver2
      ip address 10.14.1.177
      inservice
    ssl-proxy service abc.www.proxy
      key abc-II-key.pem
      cert abc-II-cert.pem
    serverfarm host abc.www.abc.qa-443
      failaction purge
      rserver abcserver1
        probe abcicmp
        inservice
      rserver abcserver2
        probe abcicmp
        inservice
    serverfarm host abc.www.abc.qa-80
      failaction purge
      rserver abcserver1
        probe abcicmp
        inservice
      rserver abcserver2
        probe abcicmp
        inservice
    sticky ip-netmask 255.255.255.255 address source abc.www.abc.qa-sticky-80
    timeout 120
    serverfarm abc.www.abc.qa-80
    sticky ip-netmask 255.255.255.255 address source abc.www.abc.qa-sticky-443
    timeout 120
    serverfarm abc.www.abc.qa-443
    class-map match-all abc.www.abc.qa-443
    match virtual-address 10.14.1.203 tcp eq https
    class-map match-all abc.www.abc.qa-80
    match virtual-address 10.14.1.203 tcp eq www
    policy-map type loadbalance first-match abc.www.abc.qa-VIP-443
    class class-default
    sticky-serverfarm abc.www.abc.qa-sticky-443
    policy-map type loadbalance first-match abc.www.abc.qa-VIP-80
    class class-default
    sticky-serverfarm abc.www.abc.qa-sticky-80
    policy-map multi-match abc-POLICY
    class abc.www.abc.qa-80
        loadbalance vip inservice
        loadbalance policy abc.www.abc.qa-VIP-80
        loadbalance vip icmp-reply
      class abc.www.abc.qa-443
        loadbalance vip inservice
        loadbalance policy abc.www.abc.qa-VIP-443
        loadbalance vip icmp-reply
        ssl-proxy server abc.www.proxy
    =============================

    Hi,
    You may want to check this thread I think it would be very helpful.
    https://supportforums.cisco.com/thread/2027253
    HTH
    Pablo
    Cisco TAC

  • Web Dispatcher with SSL termination for EP

    Hi All,
    I want to configure SAP Web Dispatcher (installed on windows) for SSL
    termination scenario. I did all the configuration steps, SSL Basic,
    SSL termination steps without Metadata Exchange scenario.
    But , when i am trying to access the portal using "<b>
    https://<DispatcherHost>:<Port>/irj/portal</b>", its giving <b>page
    can not be displayed</b> error
    <i>This is how the profile file of the dispatcher looks like,</i>
    profile file **************
    Profile generated by sapwebdisp bootstrap
    unique instance number
    SAPSYSTEM = 2
    Accessibility of Message Servers
    rdisp/mshost = <portal server>
    ms/http_port = 8101
    SAP Web Dispatcher Parameter
    wdisp/auto_refresh = 120
    wdisp/max_servers = 100
    wdisp/shm_attach_mode = 6
    configuration for large scenario
    icm/max_conn      = 16384
    icm/max_sockets   = 16384
    icm/req_queue_len = 6000
    icm/min_threads   = 100
    icm/max_threads   = 250
    mpi/total_size_MB = 500
    mpi/max_pipes     = 21000
    #maximum number of concurrent connections to one server
    wdisp/HTTP/max_pooled_con = 2000
    wdisp/HTTPS/max_pooled_con = 2000
    SAP Web Dispatcher Ports
    SAP Web Dispatcher Web Administration
    icm/HTTP/admin_0 = PREFIX=/sap/wdisp/admin,DOCROOT=./admin
    icm/server_port_0 = PROT=HTTPS,PORT=5000
    icm/server_port_1 = PROT=HTTP,PORT=0
    icm/HTTPS/verify_client = 0
    DIR_INSTANCE=D:\SAP_SSL\secudir
    ssl/ssl_lib=D:\SAP_SSL\secudir\sapcrypto.dll
    sss/server_pse=D:\SAP_SSL\secudir\SAPSSL.pse
    wdisp/ssl_encrypt = 0
    wdisp/add_client_protocol_header = true
    profile file **************
    After modifying the profile file, restarting the dispatcher gives the
    following information in the command prompt,
    Information in command prompt *******
    D:\SAP_SSL\sapwebdisp\sapwebdisp pf=sapwebdisp.pfl
    **Warning: Could not start service 5000 for protocol HTTPS on host
    <hostname>" <on all adapters>
    *SAP Web Dispatcher up and operational <pid: 1700>*
    Information in command prompt *******
    What may be problem? Did i miss out any steps ?
    Please help !
    Regards,
    Sandip

    Hi Sandip,
    Please check this thread..
    /thread/41459 [original link is broken]
    cheers,
    Prashanth
    P.S : Please mark helpful answers

  • SSL termination

    Hello!
    Could ypu help me?
    I need to get data from other system (B) (used ssl) to my sap system A via abap webservice.
    Another http web service already exists (switching on to https is not planned...) in A.
    sap crypt. library is installed. Parameters were added:
    ssl/ssl_lib = $(DIR_CT_RUN)/libsapcrypto.so
    sec/libsapsecu = $(DIR_CT_RUN)/libsapcrypto.so
    ssf/ssfapi_lib = $(DIR_CT_RUN)/libsapcrypto.so
    ssf/name = SAPSECULIB
    icm/server_port_0 = PROT=HTTP,PORT=80$$,TIMEOUT=60,PROCTIMEOUT=1500
    icm/server_port_1 = PROT=HTTPS,PORT=443,TIMEOUT=50,PROCTIMEOUT=1500
    wdisp/ssl_encrypt = 0
    wdisp/ssl_auth = 1
    For configuration SSL-termination of B and using client certificate:
    1) I need to create the PSE request for my sap system (not for B host)?
    2) To decrypt data I have to create request to CA and order certificate for my system or I can use existing client certificate?
    3) After ssl-termination abap application configured on communication via webservice as HTTP?
    http://help.sap.com/erp2005_ehp_04/helpdata/EN/a6/f19a3dc0d82453e10000000a114084/frameset.htm
    If SAP Cryptolib'll be install on AS (not only on Web Dispatcher) in future, only https we'll be used for webservices?
    Thank you!
    Antonina

    Hi,
    this [how to guide|http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/60b1edfb-2a5c-2d10-2294-d1777056c46a] should help you to set up web dispatcher in SSL termination mode. You need to create PSE used by web dispatcher (check section 3.2). I don't understand what you mean by client certificate in question 2. Yes, your web service needs to be accessible via HTTP if you want to terminate SSL on web dispatcher.
    Cheers

  • 11503 and SSL Termination - Cookie Handling

    I'm looking for some insight on how the 11503 handles SSL termination,
    specifically with regard to cookie handling. We are going to be
    installing a 11503, so it can handle load balancing, content switching
    and SSL termination instead of IIS / WLBS. If you move SSL termination
    off of the Web servers and disable SSL in IIS, how does ASP.NET handle
    secure cookies? We want to set requireSSL="true" in Web.config, but
    since the Web server will no longer be running SSL, it won't enforce
    that attribute. I was wondering if the content switch passed any
    special header to IIS, or if the content switch can be configured to
    add the secure attribute to all cookies. I haven't found anything in
    the documentation so far.

    Depending on your software version, this page has links to CSS SSL configuration Guides based upon the software you're running.
    http://www.cisco.com/en/US/customer/products/hw/contnetw/ps792/products_installation_and_configuration_guides_list.html
    You can configure the CSS to issue cookies in place of the actual server.

Maybe you are looking for

  • Going back and forth in a quiz is not allowed

    Hi, I'm using Captivate 3 and I have a question concerning the Quiz settings. The export format for my project would be HTML/Flash and EXE. I want to prepare a simple activity for Kid's where they can listen to a story and have to answer questions af

  • Database in suspect mode...why does it happen?

    I am using SQL 2012 SE with A-P clustering. We had an automatic failover around 3:00AM and the replication publisher database went into suspect mode. I gave it some time to see if it would come back to normal mode all by itself and when it did not I

  • Printing character dash on MICR printer

    Hi, C&REGUD-CHECT&C A&REGUH-UBNKL&A    &REGUH-UBKNT&C I am Using the above code to print the check number and...  On MICR printer. Above the value of REGUH-UBNKL is 60020-002 on printer it is printing 60020 002   but I want to print this 60020’’’002

  • There is an "unknown" user in my folder info windows

    Who is this mysterious "unknown" user? I can never change his (or her) Privileges. The icon, currently grayed out, is of a user behind a timepiece, a Lépine by the looks of it. How can I get rid of him (or her) without actually defenestrating my lapt

  • 'an unknown error has occurred (0x80090318)

    When I try and connect to the store one my computer it comes up with 'an unknown error has occurred (0x80090318) I have made sure the internet is connected and working and I have tried other computers and I have also tried to check for updates but it