For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JA500001's avatar
JA500001
Icon for Nimbostratus rankNimbostratus
Feb 12, 2020

Creating a dynamic AIA compatible OCSP responder object

Hello everyone, I am currently tasked with building a dynamic OCSP responder object for use with PSD2 and open banking. The requirement for this responder is that is able to dynamically inspect the A...
BIG-IP Access Policy Manager (APM)
security
Dave_W's avatar
Dave_W
Icon for Employee rankEmployee
Feb 14, 2020

Hello, I think this might work if you leave the "Ignore AIA" unchecked and leave the URI field in the OCSP Responder blank. I believe it would then use the URI from the Cert itself.

  • JA500001's avatar
    JA500001
    Icon for Nimbostratus rankNimbostratus
    Feb 15, 2020

    thanks for this Dave! One thing I notice when I do this is that the object seems to require a Certificate Authority file to be set regardless of whether AIA is checked or unchecked. There is no option in the drop down for 'none' or pull CA authority from the certificates AIA section.. Any ideas? I guess I can just try to select any old CA to get the object to complete so I can then try it out.. just seems a bit strange that its mandating that I supply something here, when the whole purpose of the AIA behaviours are that it (should) dynamically retrieve the ocsp responder endpoint and its associated CA file from the certificate rather than having to specify it manually/explicitly.

     

    I've raised a formal support ticket with F5 as the information on this is pretty sparse in details to say the least. If I get anything useful from that route I will be sure to post it back in here for suture reference in case others need it.

    • Dave_W's avatar
      Dave_W
      Icon for Employee rankEmployee
      Feb 17, 2020

      Yes, that does not seem to be much useful info on that part of the configuration. From the internal help I found this:

       

      "Specifies the name of the file containing trusted CA certificates used to verify the signature on the OCSP response.

       

      Note: The OCSP responder works with files in PEM encoding format. If a file was in DER format when it was imported, it remains in DER format in the BIG-IP SSL certificate file store. Transform any certificate authority file for use with OCSP responder into PEM format and then import it."