Forum Discussion

Shaun_Simmons1's avatar
Shaun_Simmons1
Icon for Altostratus rankAltostratus
Jun 22, 2015

LTM OCSP capability: CRL maximum file / database size

What is the maximum PEM size the LTM is capable of handling? I have a 450MB PEM file and heard from an F5 engineer that LTM is only able to handle up to a certain size? I am looking to replace our ...
Shaun_Simmons1's avatar
Shaun_Simmons1
Icon for Altostratus rankAltostratus
Jun 22, 2015

Answer found:

 

https://support.f5.com/kb/en-us/solutions/public/10000/000/sol10054.html BIG-IP version Maximum PEM file size Maximum DER file size

 

-=11.4.0 - 11.6.0=- PEM 64 MB DER 64 MB

 

-=11.0.0 - 11.3.0=- PEM 32 MB DER 32 MB

 

-=10.0.0 - 10.2.4=- PEM 4 MB DER 3 MB

 

If you attempt to load a Secure Socket Layer (SSL) profile with a CRL file larger than the aforementioned limits, an error message that appears similar to the following example is logged to the /var/log/ltm file:

 

01260018:3: OpenSSL: error:0906D041:PEM routines:PEM_read_bio:malloc failure

 

Note: 85,000 serial numbers utilize approximately 4 MB of a CRL file.

 

Note: The BIG-IP system must have sufficient memory available to allocate the CRL file into memory.