Citrix ADC

如果设备没有域特定 (SNI) 证书,则配置 SSL 操作以转发客户端流量

注意:此功能在版本 12.1 版本 49.x 及更高版本中可用。

在客户端 Hello 消息中,如果您收到一个域的请求,该域的证书在设备上不可用,则可以配置 SSL 操作以将客户端流量转发到其他虚拟服务器。如果不希望在设备上卸载 SSL,请将流量转发到 TCP 或 SSL_Bridge 类型的虚拟服务器。对于 SSL 卸载,请将流量转发到 SSL 虚拟服务器。在以下示例中,我们将 SSL 虚拟服务器配置为转发虚拟服务器。此设置可确保因原始虚拟服务器上缺少 SNI 证书而失败的所有连接在转发虚拟服务器上都成功。

执行以下步骤:

  1. 添加 SSL 类型的负载平衡虚拟服务器(例如,v1)。此虚拟服务器上接收客户端流量。
  2. 添加带端口 443 的 SSL 服务。
  3. 将此服务绑定到 SSL 虚拟服务器。
  4. 添加另一个 SSL 类型的负载平衡虚拟服务器以将流量转发到。(例如, fwd-虚拟服务器)。
  5. 添加服务并将其绑定到此虚拟服务器。
  6. 将此服务绑定到 SSL 虚拟服务器。
  7. 在“转发”参数中添加一个 SSL 操作,指定 SSL 虚拟 服务器 fwd-虚拟服务器
  8. 如果客户端 hello 消息中收到特定域名 (SNI),则添加 SSL 策略,指定上述操作。
  9. 将此策略绑定到 SSL 虚拟服务器 v1。
  10. 保存配置。

使用 CLI 进行配置

要将流量转发到的 SSL 虚拟服务器的配置

add lb vserver fwd-vserver SSL 10.102.57.184 443
add ssl certkey sv -cert complete/server/server_rsa_2048.pem -key complete/server/server_rsa_2048.ky
bind ssl vserver fwd-vserver -certkeyName sv
bind ssl vserver fwd-vserver -certkeyName cacert -CA
add service ssl-service2 10.102.113.150 SSL 443
bind lb vserver fwd-vserver ssl-service2

最初接收客户端流量的 SSL 虚拟服务器的配置

add service ssl-service 10.102.113.155 SSL 443
add lb vserver v1 SSL 10.102.57.186 443
bind ssl vserver v1 -certkeyName sv
bind lb vserver v1 ssl-service
set ssl vserver v1 -sni ENABLED
add ssl certKey snicert2 -cert /nsconfig/ssl/complete/SNI/server/serverabc.pem -key /nsconfig/ssl/complete/SNI/server/serverabc.ky
add ssl certKey snicert -cert /nsconfig/ssl/complete/SNI/server/serverabcnetscaler.pem -key /nsconfig/ssl/complete/SNI/server/serverabcnetscaler.ky
bind ssl vserver v1 -certkeyName snicert -sniCert
bind ssl vserver v1 -certkeyName snicert2 -sniCert
add ssl action act1 -forward fwd-vserver
add ssl policy pol1 -rule client.ssl.client_hello.sni.contains("xyz") -action act1
bind ssl vserver v1 -policyName pol1 -type CLIENTHELLO_REQ -priority 1
sh ssl vserver v1

    Advanced SSL configuration for VServer v1:
    DH: DISABLED
    DH Private-Key Exponent Size Limit: DISABLED    Ephemeral RSA: ENABLED  Refresh Count: 0
    Session Reuse: ENABLED  Timeout: 120 seconds
    Cipher Redirect: DISABLED
    SSLfwd-vserver Redirect: DISABLED
    ClearText Port: 0
    Client Auth: DISABLED
    SSL Redirect: DISABLED
    Non FIPS Ciphers: DISABLED
    SNI: ENABLED
    OCSP Stapling: DISABLED
    HSTS: DISABLED
    HSTS IncludeSubDomains: NO
    HSTS Max-Age: 0
    SSLfwd-vserver: DISABLED  SSLv3: ENABLED  TLSv1.0: ENABLED  TLSv1.1: ENABLED  TLSv1.2: ENABLED  TLSv1.3: DISABLED
    Push Encryption Trigger: Always
    Send Close-Notify: YES
    Strict Sig-Digest Check: DISABLED
    Zero RTT Early Data: DISABLED
    DHE Key Exchange With PSK: NO
    Tickets Per Authentication Context: 1

ECC Curve: P_256, P_384, P_224, P_521

1)  CertKey Name: sv    Server Certificate
2)  CertKey Name: snicert2  Server Certificate for SNI
3)  CertKey Name: snicert   Server Certificate for SNI


Data policy
1) Policy Name: pol1    Priority: 1



1) Cipher Name: DEFAULT
Description: Default cipher list with encryption strength >= 128bit
Done
sh ssl policy pol1
    Name: pol1
    Rule: client.ssl.client_hello.sni.contains("xyz")
    Action: act1
    UndefAction: Use Global
    Hits: 0
    Undef Hits: 0


    Policy is bound to following entities
1)  Bound to: CLIENTHELLO_REQ VSERVER v1
    Priority: 1

Done
sh ssl action act1
1)  Name: act1
    Type: Data Insertion
    Forward to: fwd-vserver
    Hits: 0
    Undef Hits: 0
    Action Reference Count: 1
Done
sh ssl vserver fwd-vserver

    Advanced SSL configuration for VServer fwd-vserver:
    DH: DISABLED
    DH Private-Key Exponent Size Limit: DISABLED    Ephemeral RSA: ENABLED  Refresh Count: 0
    Session Reuse: ENABLED  Timeout: 120 seconds
    Cipher Redirect: DISABLED
    SSLfwd-vserver Redirect: DISABLED
    ClearText Port: 0
    Client Auth: DISABLED
    SSL Redirect: DISABLED
    Non FIPS Ciphers: DISABLED
    SNI: DISABLED
    OCSP Stapling: DISABLED
    HSTS: DISABLED
    HSTS IncludeSubDomains: NO
    HSTS Max-Age: 0
    SSLfwd-vserver: DISABLED  SSLv3: ENABLED  TLSv1.0: ENABLED  TLSv1.1: ENABLED  TLSv1.2: ENABLED  TLSv1.3: DISABLED
    Push Encryption Trigger: Always
    Send Close-Notify: YES
    Strict Sig-Digest Check: DISABLED
    Zero RTT Early Data: DISABLED
    DHE Key Exchange With PSK: NO
    Tickets Per Authentication Context: 1

    ECC Curve: P_256, P_384, P_224, P_521

1)  CertKey Name: sv    Server Certificate



1)  Cipher Name: DEFAULT
    Description: Default cipher list with encryption strength >= 128bit
Done

如果设备没有域特定 (SNI) 证书,则配置 SSL 操作以转发客户端流量