Specifying Secure Url Rewrite - Cisco 11503 - CSS Content Services Switch Configuration Manual

Chapter 4 Configuring SSL Termination
Configuring Virtual SSL Servers for an SSL Proxy List
The unclean-shutdown option for the ssl-server command instructs the CSS to
send only a TCP FIN message to terminate a client connection. The CSS does not
send a Close-Notify alert to close a client connection.
For example, to configure the CSS to send only a TCP FIN message to terminate
a client connection, enter:
(config-ssl-proxy-list[ssl_list1])# ssl-server 20 unclean-shutdown
The no version of this command resets the CSS default behavior of sending both
a Close-Notify alert and TCP FIN message to close the client connection. For
example, enter:
(config-ssl-proxy-list[ssl_list1])# no ssl-server 20 unclean-shutdown

Specifying Secure URL Rewrite

Client HTTPS connections can become HTTP connections when sent to a
back-end server through a virtual SSL server in the SSL proxy list. The back-end
server receives data as clear text from the client in the HTTP connection. If the
server performs an HTTP 300-series redirect to another HTTP URL, the redirect
causes the client to perform an HTTP request even though the client originally had
been performing an HTTPS request. Because the client's connection changes to
HTTP, the requested data may not be available from the server using a clear text
connection.
Do not specify secure URL rewrite as a configuration parameter for the virtual
Note
SSL server if you plan to include one or more back-end SSL servers in the SSL
proxy list (as described in the "Specifying the Nagle Algorithm for SSL TCP
Connections" section).
You can avoid problems with nonsecure HTTP redirects from the back-end server
by configuring one or more URL rewrite rules. Each rewrite rule is associated
with a virtual SSL server in the SSL proxy list. URL rewrite rules resolve the
problem of a web site redirecting the user to a nonsecure HTTP URL by rewriting
the domain from http:// to https://. By using URL rewrite, all client connections
to the Web server will be SSL, ensuring the secure delivery of HTTPS content
back to the client.
Cisco Content Services Switch SSL Configuration Guide
4-35
OL-5655-01