For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Biche_XD_185704's avatar
Biche_XD_185704
Icon for Nimbostratus rankNimbostratus
Oct 03, 2018

[OCSP Stapling] Globalsign configuration

Hi everyone, My objective is simple : I want to set OCSP Stappling configuration on my HTTPS VIP. For that, I follow this article For information, Globalsign is my SSL provider and I have wildcar...
application delivery
BIG-IP
LTM
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 09, 2018

You can use ssldump to determine if stapling is actually happening.

ssldump -AdNn -i [client side VLAN] port 443 [and any other filters]

You'll see the status_request message in the Client Hello, and if the server supports it, a stapled response in Certificate Status. And compare this to a known-good stapling site like https://www.bing.com.

If you do see stapling transactions, it could be that Firefox (or SSLLabs) doesn't specifically trust the signer of your stapled response.