F5 BIG-IP SSLVPN client using machine certs and renewal of the issuing intermediate CA

Thanks.

I would modify the CA bundle by adding the entire SSL cert chain (root+intermediate) rather than the lone intermediate cert.

In other words, I would concatenate your CA root and new intermediate cert into one file then add the concatenated file to the existing CA bundle.

Keep in mind that you may have to click [Update] on your client SSL profile even though no changes are being made on that page. I've had issues with SSL forward proxy setups where changes made to a datagroup referenced by the SSL profile weren't being re-read until [update] was executed.