OCSP w/ requested client certifications.

Here's a great example in the codeshare that you may want to take a look at: Click here.

It's a little advanced, but it does some things that you'll want to look through, like:

} elseif {([matchclass [TCP::local_port] equals $::vip_http_ports]) }{
       Request was to an HTTP port, not an HTTPS port, so disable client SSL profile if one is enabled on the VIP
      set vip_http_port 1
      if {$::debug}{log local0. "HTTP request from [IP::client_addr] to [IP::local_addr]:[TCP::local_port]"}
       Check to see if there is a client SSL profile and if so, disable it
      if { [PROFILE::exists clientssl] == 1} {
         if {$::debug}{log local0. "Client SSL profile enabled on VIP.  Disabling SSL"}
         set disable_cmd "SSL::disable"
         eval $disable_cmd
      } 
   }

This still doesn't solve the issue of determining when you want the profile enabled/disabled, but at least it shows you how to turn it on/off.

Colin