APM CRLDP

Of course, if the crldp field in your cert is invalid or non existent. You have a problem. To workaround this, you can define a crl in the clientssl profile and update it using cron and tmsh

if I understand - for HTTP CRL you must use cert CRL field when using CRLDP

You should use an CRLDP AAA object and select the option No Server. This way, the bigip APM will use the crldp field in the client certificate. You have to add a CRLDP block in your VPE

If there is no crldp fields in the client cert, you can configure the Certificate Revocation List option in the Client Authentication settings within your clientssl profile. No need to add a CRLDP block in you VPE, a Client Certificate Inspection is enough

And to update your crl, you can use a cron job in cli. Here the tmsh command to update your crl : modify sys file ssl-crl mycrl.file source-path http://mycrldpuri/MyCA.crl

thank you for the helpful information