Forum Discussion

luigi_bros's avatar
luigi_bros
Icon for Nimbostratus rankNimbostratus
Oct 26, 2017

CA Certificate Authorities DST ACES CA X6 - DigiNotar expired

Dears all,   The Certificate Authorities Bundle in the BIG-IP box has a few root/intermediary certificates expired or expiring soon. Some of them are "DigiNotar", "DST ACES CA".   I know that u...
BIG-IP
LTM
security
Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
Oct 26, 2017

Greetings Luigi,

 

It may be easier to simply download the most recent CA bundle and associate that with the client SSL profile. If you navigate to downloads, look for "Certificate-Authority-Bundle":

 

https://downloads.f5.com/esd/productlines.jsp

 

Alternatively, you can try the workaround in the article you mentioned: K15847.

 

Hope this is helpful!

 

Kevin

 

Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
Nov 06, 2017

Hi Luigi,

 

The ca-bundle.crt shouldn't take up much disk space, can you leave it on the BIG-IP and reference the newly imported one? Just give it a different name when you import it:

 

ca-bundle-2017.crt

 

If you've configured email alerts, you can stop them with the following:

 

https://support.f5.com/csp/article/K36641730

 

Hope this is helpful!

 

Kevin