Virtual services have a configuration option to enable virtual hosting support. Enabling this option within a virtual service indicates the virtual service is a parent or child of another service in a server name indication (SNI) deployment.

During the SSL handshake between a client and a parent virtual service, the parent virtual service checks the domain names of its children virtual services for a match with the domain name in the client’s handshake. If there is a match, the parent virtual service passes the client request to the child virtual service with the matching domain name. Wildcards can be used to match the beginning or end of the domain name.

Wildcards

Within a child virtual service’s configuration, a wildcard character can be used at the beginning or end of the domain name:

  • *.example.com - Matches on any labels at the beginning of the domain name if the rest of the domain name matches. This example matches mail.example.com, app1.example.com, app1.test.example.com, app1.test.b.example.com, any.set.of.labels.in.front.of.example.com, and so on.

  • .example.com - Matches on any set of first labels or no first label. This example matches not only on any domain name matched by *.example.com but also on “example.com” (with no other label in front).

  • www.example.* - Matches on any set of ending labels if the other labels match. This example matches www.example.com, www.example.org, www.example.edu, www.example.edu.any.set.of.labels.after.www.example, and so on.

A domain name can contain any of these wildcard characters, in the positions shown. The use of wildcards in other label positions within a domain name is not supported. Similarly, using multiple wildcard characters within the same domain name is not supported.

Longest Match is Used

For multiple matches, the longest, most specific match is used.

For example, suppose a parent virtual service has the following child virtual services:

  • VS1: matches on domain name *.example.com

  • VS2: matches on domain name *.test.example.com

If the server certificate contains a domain name that ends with “.test.example.com,” the certificate matches on VS2 but not on VS1.