Forum Discussion
APM OCSP Responder fall back question
We have APM configured to do OCSP checks on client certs. The OCSP Responder AAA Server has the correct URL configured but "ignore AIA" was not checked. This worked fine in testing. But when it was put into production, authentication started failing with OSCP Responder issues. We found that the f5 was trying a URL from the AIA in the user's Cert, however it was not for an OCSP method of the AIA (in fact it was the Enrollment URL). The Certs' AIA fields from the old CA do not have the OCSP method defined as we've just added OCSP to support the f5 roll out. Checking the "ignore AIA" Option solved the problem.
What I'm trying to confirm is, does APM (ver 12.1.2) first attempt the configured OCSP URL and if it fails or times out, goes looking at the AIA?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com