For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus
Jun 01, 2016

Hi,

 

I strongly not recommend to configure load balancing to manage certificate lifecycle. Are you configuring ADCS clustering or do you have only 2 different Intermediate CA. Are you using SCEP ?

 

But, if you really need to loadbalance your CAs, you can create a "Performance L4" VS, assign a pool containing both CA members and add source address persistence to your VS.

 

Depending on the certificate delivery workflow, you will not be able to guarantee that the user come to the same CA during the whole enrollment process.

 

You can load balance OCSP request to ocsp responders and of course CRL distribution points to (recommended for security reason) an external website (can be ocsp responders)