5 ms·

They have a valid cert in use that only expires in 2019, and it's SHA256. But when you visit over HTTPS, this happens: HTTP/1.0 302 Found Location: http://

• zokier 10y ago
  Does TLS termination cost extra for BigIP? Maybe their license expired or something?
  • doubleplusgood 10y ago
    TLS offload is usually extra on F5 BigIP
    • Karunamon 10y ago
      Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? I know one of our network admins is continually complaining about how shitty their UI is...
      • corrigible 10y ago
        Not an expert, but the last BIG-IP LTM I saw a couple of months ago didn't support TLS acceleration without a dedicated hardware module (and the accompanying license); this would usually mean upgrading to a more expensive model. Plain old TLS termination isn't license-limited as far as I know. EDIT: to answer your question, yes, you could probably do it with haproxy, but the added value in these appliances is iRules (TCL hooks for all network events, you could augment request processing etc) and vendor support.
      • xorcist 10y ago
        F5 has some secret sauce to it but it's mostly performance related. They have a good chunk of hardware offloading, all the way up to the TLS layer. I seem to remember even the entry license includes full TLS offloading so I doubt the poster above is correct that it is a cost issue. As to if HAProxy can do the job, well, that depends. F5s are complex beasts and they can load balance application specific protocols that can be hard to find elsewhere, with the support contract that goes with it.
        • mdekkers 10y ago
          crypto offloading isn't hard, and can be done on the NIC if you want/need: https://www.nextplatform.com/2016/10/03/server-encryption-fpga-offload-boost/ https://www.nextplatform.com/2016/10/03/server-encryption-fp...
          • otterley 10y ago
            Can you show us how to configure that on a typical box?
            • mdekkers 10y ago
              Of course, but that is chargeable work.
        • corrigible 10y ago
          SSL offloading is license-limited (TPS-wise) on physical F5 appliances, E.G., `10250v` vs `10200v-SSL`.
      • mdekkers 10y ago
        Does F5 do any special secret sauce that can't be replicated with an equally powerful set of hardware and a good HAProxy config? Not unless you think "extract a lot of money from clueless execs" is secret sauce. That, and support contracts - you know, throats to choke when it all goes wrong.
        • otterley 10y ago
          BigIP's iRules (Tcl) are pretty nice. (https://devcentral.f5.com/irules https://devcentral.f5.com/irules). I hear HAproxy has Lua support now, but I don't know how comprehensive it is compared to iRules. Also, F5 load balancers have real hardware failover capability, and can even synchronize TCP session state across instances. That's a pretty nice feature.
          • mdekkers 10y ago
            I worked with BigIP for a few years, and I believe that the real value is in the support contracts, and the peace of mind that gives to enterprise execs. failover (local or global) as well as state sync is all do-able with linux or bsd, but that will take time and work. BigIP is more or less plug and play. This is the case for many "enterprisey" products. Personally, I prefer to go the linux/bsd route, since it forces you and your team to have a deeper understanding of what you are building, which is really handy for when things break.