Forwarding OCSP request to a specific responder (or profile)

Hi all.

 

We have this web service where we need to authenticate users (x509 mutual authentication). So we also need to verify the revocation status of users certificates. All these user certificates are signed by a bundle of cas (so the ocsp responder is not always the same). We discovered that creating a responder leaving the URL field empty let the bigip to extract AIA field from user certificate and forward the ocsp request to the specific remote responder. This works well. But this AIA field is not present in all certificates. So what we would like to do is to manually forward the request to a specific responder or profile (already configured on the bigip) the moment we detect a certificate where the AIA field is missing (we know this by reading issuer hash the moment user certificate is presented).

 

Any ideas?

 

Thanks