For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Janek_42109's avatar
Janek_42109
Icon for Nimbostratus rankNimbostratus
Aug 26, 2015

APM - Custom CRLDP not based on client certificate

Hello All,   Is there a way on the APM policy to verify the client certificate via an HTTP CRLDP that is not based on the information from the client certificate but manually defined ?   Thank ...
BIG-IP Access Policy Manager (APM)
client cert
crldp
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Aug 26, 2015

In short, no. When you select "No Server" as the Server Connection option in the CRLDP AAA, it'll follow the HTTP CRLDP URL in the client certificate. The other Server Connection options are for LDAP-based CRLDPs. If you're willing to host the CRLs locally (on some local web server), you could force the real URLs to resolve locally with Hosts entries. Otherwise you'd have to try to rewrite the CRLDP field in the X509 before it got to this agent. It is definitely possible but not trivial.