Forum Discussion

SMilanic's avatar
SMilanic
Icon for Cirrus rankCirrus
Mar 06, 2024

Dynamic CRL Check with Client SSL Profile - How to notify the user?

Hi,    we have implemented dynamic CRL checking with client SSL profile in our test environment with BIG-IP 15.1.  And it works. If a test user tries to establish a SSL session to a VIP with dynam...
crl
crldp
LTM
ssl
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Apr 09, 2024

    Spit-balling here, but do you have Client Certificate auth set to Request or Require? The latter will terminate the session if validation fails. The former will not.

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Apr 09, 2024

Spit-balling here, but do you have Client Certificate auth set to Request or Require? The latter will terminate the session if validation fails. The former will not.

  • SMilanic's avatar
    SMilanic
    Icon for Cirrus rankCirrus
    Apr 09, 2024

    Hi Kevin, 

    Yes, in fact, setting the Client cert auth to "Request" instead of "Require" solved the problem. 

    When the Client cert auth is set to "Request", we can catch the result in an iRule and redirect the client's browser to an error page.