Multiple (many) OCSP responders, multiple CAs and certificate check

Hello,

 

 

Is there a way to check certificates revocation status for a pre-loaded list of trusted CAs (50 to 100), just like a browser would do ?

 

The BIG-IP should extract the AIA field from the certificate and use it to contact the OCSP responder.

 

Is it something that the BIG-IP is aimed to do (just not check one or two OCSP responders, but many)? What is the limit?

 

Has it been done before ? Does someone have a configuration example?

 

 

Subsidiary question: if the AIA field does not exist, can the BIG-IP use the CRL field as a fallback? (again, just like internet browsers can do)

 

 

Kind regards