Forum Discussion

Shaun_Simmons1's avatar
Shaun_Simmons1
Icon for Altostratus rankAltostratus
Jun 22, 2015

LTM OCSP capability: CRL maximum file / database size

What is the maximum PEM size the LTM is capable of handling? I have a 450MB PEM file and heard from an F5 engineer that LTM is only able to handle up to a certain size? I am looking to replace our "home grown" OCSP server and replace it with the LTM.

 

Thanks!

 

1 Reply

  • Shaun_Simmons1's avatar
    Shaun_Simmons1
    Icon for Altostratus rankAltostratus
    Jun 22, 2015

    Answer found:

     

    https://support.f5.com/kb/en-us/solutions/public/10000/000/sol10054.html BIG-IP version Maximum PEM file size Maximum DER file size

     

    -=11.4.0 - 11.6.0=- PEM 64 MB DER 64 MB

     

    -=11.0.0 - 11.3.0=- PEM 32 MB DER 32 MB

     

    -=10.0.0 - 10.2.4=- PEM 4 MB DER 3 MB

     

    If you attempt to load a Secure Socket Layer (SSL) profile with a CRL file larger than the aforementioned limits, an error message that appears similar to the following example is logged to the /var/log/ltm file:

     

    01260018:3: OpenSSL: error:0906D041:PEM routines:PEM_read_bio:malloc failure

     

    Note: 85,000 serial numbers utilize approximately 4 MB of a CRL file.

     

    Note: The BIG-IP system must have sufficient memory available to allocate the CRL file into memory.