1

i have a setup with following environment:

2 FE with cache 2 App with search

default portal is working on port 80 and load balancing and high availability is configured in F5.

Now i want to enable https for the same portal and want to offload the certificate on F5. i was working on a separate ticket with MS and they told me AAM is not the correct way to enable SSL as it will impact your crawling search and it did.

The correct way is to that use Extend web app and give another port your web application. The only confusion here is as I am offloading the certificate on F5 which is handling LB and HA, while configuring extend application what should i select "Use SSL" or not. in case if is select use SSL then i have to import certificate on both FE servers and SSL Offloading will not serve the purpose.

Can anyone please let me know how this kind of setup works ? what is the best way/practice to enable HTTPs on Sharepoint keeping in mind that on the frond side we have F5, (user request will go to F5 LB).

Regards, Thank You

Improve this question
3
  • 1
    Is there a reason you're offloading? This creates a significant security issue with OAuth tokens (used for WFM, OOS/OWA, Exchange, Addins) as those tokens rely on transport security.
    – user6024
    Jan 21, 2019 at 5:48
  • We dont want to maintain certificates on application servers. F5 is central place to maintain n assign certs. this is you can say our company standard.
    – Irfan Ali
    Jan 22, 2019 at 7:04
  • As long as you're aware you're trading a significant security risk for convenience if you use any of the services I mentioned.
    – user6024
    Jan 22, 2019 at 13:57

1 Answer 1

Reset to default
0

Ok so you will still require to configure AAM for the SSL to work anyway but you will need to configure it for the extended web application. The non extended web application will be used for crawling and then you will use the server mapping feature of search to map the results from the non extended to the extended we app. While extending the web app you should not mark it to use the ssl (you should extend it as well to port 80). I use Netscaler and in our config we had to add rewrite action to give the requests additional header 'Fron-End-Https' probably something similar needs to happen on your F5.

REF: https://www.citrix.com/content/dam/citrix/en_us/citrix-developer/documents/Netscaler/how-to-indicate-sharepoint-application-servers-that-ssl-offload-is-enabled-in-netscaler-and-end-client-is-using-https.pdf

Improve this answer
1
  • Hi, i will test it in my environment and let you know the outcome.
    – Irfan Ali
    Jan 22, 2019 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.