For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Erich_Rockman_1's avatar
Erich_Rockman_1
Icon for Cirrus rankCirrus
Apr 06, 2017

APM CRLDP Response

Hey all. I am able to use CRLDP cert check in APM (v11.6HF6). OCSP is not an option as the ocsp x509 extension does not exist in all my certs and I do not want to keep a list of issuers to OCSP profi...
BIG-IP Access Policy Manager (APM)
crldp
security
Erich_Rockman_1's avatar
Erich_Rockman_1
Icon for Cirrus rankCirrus
Apr 08, 2017

Thanks for the reply. I have done all that. The problem is that there is no extended information when the CRL cannot be contacted. This is in the sessiondump:

 

414ca204.session.crldp./Common/Policy_act_crldp_auth_ag_1.result 1 1 414ca204.session.crldp.last.result 1 1

 

while this is in the APM debug:

 

modules/Authentication/Crldp/CrldpAuthModule.cpp func: "setCrldpResponseStatus()" line: 796 Msg: Crldp Response Status: Bad HTTP response status and Following rule 'Successful' from item 'CRLDP Auth'

 

Not sure I would call that successful.