For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ray_74718's avatar
Ray_74718
Icon for Nimbostratus rankNimbostratus
Dec 11, 2013

Failed to initialize OCSP Auth Module

Hi all,   I want to implement OCSP Auth with APM to Microsoft PKI. On-Demany-Cert Auth is working. I don't see any communication in tcpdump to ocsp responder.   Erro Message: 'failed to initial...
Ray_74718's avatar
Ray_74718
Icon for Nimbostratus rankNimbostratus
Dec 15, 2013

I created an OCSP responder with URL of http://ocsp.example.com and assigned the certificate authority file. All other values were left at their defaults. In the VPE I created the "ocsp auth" agent directly after "on-demand-cert Auth" and assigned the previously created ocsp responder.

 

I always get this message in apm log: "failed to initialize ocsp auth module".

 

in the tcpdump there is no ocsp request going to microsoft ca from apm. tcpdump -ni 0.0 -s0 host ocsp.example.com and port 80

 

So why is apm not sending out an ocsp request ?

 

I did a test with openssl, but seems that microsoft ca does not allow post requests:

 

openssl ocsp -issuer MY-ROOT-CA.pem -cert bob.pem -url http://ocsp.example.com -CAfile MY-ROOT-CA.pem Error querying OCSP responsder 9886:error:27075072:OCSP routines:PARSE_HTTP_LINE1:server response error:ocsp_ht.c:224:Code=405,Reason=Method Not Allowed

 

Any clues ?

 

THX