| Mise en place de HTTP|2 sur un BigIP F5 |
| Article original Publié le : 09 novembre 2019 Mise a jour le : – |
Cela s’active sur le VS du site
Mais a l’activation cela renvoi l’erreur suivante
|
1 |
Configuration error: In Virtual Server (/Common/url_site.domaine.tld_https) an http2 profile with enforce-tls-requirements enabled is incompatible with client ssl profile '/Common/ssl_client_xxx_tls12'; renegotiation must be disabled |
Il y a plusieurs profiles ssl déclarés dans ce VS et comme indiqué dans l’erreur la renégociation est incompatible avec enforce-tls-requirements
Il faut donc modifier chaque profile et décocher la renégociation,
|
1 |
Local Traffic ›› Profiles : SSL : Client ›› ssl_client_xxx_tls12 |
/!\ Il est nécessaire de désactiver sur tous les profils liés a ce VS, sinon il y aura un des erreurs de synchronisation avec le slave.
Pour faire le test
|
1 |
$ curl -vsko /dev/null --http2 https://url_site.domaine.tld |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
* Rebuilt URL to: https://url_site.domaine.tld/ * Trying xxx.xxx.xxx.xxx... * TCP_NODELAY set * Connected to url_site.domaine.tld (xxx.xxx.xxx.xxx) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs } [5 bytes data] * TLSv1.3 (OUT), TLS handshake, Client hello (1): } [512 bytes data] * TLSv1.3 (IN), TLS handshake, Server hello (2): { [104 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [2922 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [333 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [70 bytes data] * TLSv1.2 (OUT), TLS change cipher, Client hello (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 * ALPN, server accepted to use h2 * Server certificate: * subject: OU=Domain Control Validated; CN=*.domaine,tld * start date: Oct 12 07:05:56 2017 GMT * expire date: Oct 12 07:05:56 2020 GMT * issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Domain Validation CA - SHA256 - G2 * SSL certificate verify ok. <strong>* Using HTTP2, server supports multi-use</strong> <strong>* Connection state changed (HTTP/2 confirmed)</strong> * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 } [5 bytes data] * Using Stream ID: 1 (easy handle 0x55e1cc88c5a0) } [5 bytes data] <strong>> GET / HTTP/2</strong> > Host: url_site.domaine.tld > User-Agent: curl/7.58.0 > Accept: */* > { [5 bytes data] * Connection state changed (MAX_CONCURRENT_STREAMS updated)! } [5 bytes data] < HTTP/2 302 < date: Mon, 21 Oct 2019 13:54:12 GMT < x-redirect-by: WordPress < location: /?doing_wp_cron=1571666053.1167740821838378906250 < content-type: text/html; charset=UTF-8 < set-cookie: BIGipServerpool_pool_http=3456106506.20480.0000; path=/; Httponly; Secure < { [5 bytes data] * Connection #0 to host url_site.domaine.tld left intact |