APM 17.5.1.9 certcheck (failures, exceptions)

Hi nicholse

I checked the information that you put in the post and I belive that f5mcertcheck.txt is generated by the Client/Machine Cert Inspection component (f5certchk.dll), documented in F5 K000150897 and K00819308. Your log already shows current log level = 63 (max local verbosity), so this isn't a client-side logging config gap on your end.

I believe the real cause is a documented behavior change introduced in APM Client (Edge Client) 7.2.7, not a bug. From the official 7.2.7 release notes ("Features and enhancements" → Custom Logging Preferences for Windows Edge Client):

"You can select the required log level from APM Client Log Level drop-down in General Settings while creating a connectivity profile from Access > Connectivity/VPN > Connectivity > Profiles in BIG-IP. By default, it is set to Info. Note: If the BIG-IP Server log level is set to ERROR, WARN, or INFO, it will override the Client Log Level. The APM Client Log Level is considered only when the BIG-IP Server log level is set to DEBUG or TRACE. If they differ, the lower log level (less verbose) is applied. [...] This feature requires BIG-IP version 21.1 or later."

In other words, starting with Edge Client 7.2.7, the effective logging level written to disk is the lower (less verbose) of the client's local level and a server-side log level — and the UI to raise that server-side level to DEBUG/TRACE (Access > Connectivity/VPN > Connectivity > Profiles > General Settings > APM Client Log Level) only exists on BIG-IP 21.1+. Since you're on 17.5.1.9, that knob isn't available, so the per-certificate match trace (certinfo.cpp :: MatchCertificate, FindCertificateInStoreExt: Total certs tested, etc. — all Debug/Trace-level lines) gets suppressed even though your local client still reports level 63.

A few things worth checking/trying:

1. Confirm the Edge Client build on the affected endpoint (Help/About, or Programs and Features) — if it's 7.2.7 or 7.2.7.1, that lines up exactly with when this changed (those are also the client versions currently listed as compatible with 17.5.1.x).
2. The same release note calls out a client-side override for exactly this situation: "the MachineLogLevel must be manually created in the Registry Editor if detailed debug-level logging is required on the client side." Try creating MachineLogLevel (string/DWORD) under HKLM\Software\F5 Networks\RemoteAccess set to DEBUG and re-test — it's documented as the way to force detailed debug logging locally regardless of the server-side gate, though I haven't been able to confirm whether it restores the certcheck match-loop trace specifically or only the Machine Tunnel logging.
3. As a data point, rolling back to a pre-7.2.7 Edge Client build (e.g., 7.2.6.x) on a test machine should restore the old always-verbose behavior, which would confirm the client version (not the BIG-IP TMOS version) is what's actually gating this.
4. I didn't find any Known Issue for BIG-IP 17.5.1.9 or Edge Client 7.2.7/7.2.7.1 that documents this as a defect — it reads as an (undocumented-for-older-TMOS) side effect of the new logging feature rather than a regression bug. Since auth is still succeeding, there's no functional/security impact, just reduced local diagnostic visibility.

If the registry override in #2 doesn't restore the detail you need, I'd open a case with F5 Support referencing this release note directly and ask whether there's any way to get server-side DEBUG/TRACE log-level behavior on pre-21.1 BIG-IP, since the Connectivity Profile control for it appears to be 21.1+ only.

Link 

• (Machine Cert Auth Pattern Matching — confirma ubicación y propósito de f5mcertcheck.txt) 
• (Gathering F5 VPN client logs — lista oficial de logs del cliente, incluye f5mcertcheck.txt) 
• APM Client Release Notes 7.2.7 – Features and enhancements