For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nuruddin_Ahmed_'s avatar
Nuruddin_Ahmed_
Icon for Cirrostratus rankCirrostratus
Sep 05, 2016

require client authentication certificate

Hi,   by default, require client authentication certificate validates what parameters? is it just validates the root & intermediate certificates?   Regards  
application delivery
LTM
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 05, 2016

It's going to check at least 2 things:

 

  1. Certificate validity, which includes X.509 structure and constraints, and validity times

     

  2. Trust, which must be established from the client cert all the way up to the self-signed root CA. In (I believe) 11.4 and above, the client SSL profile has that ability to consume subordinates (but not the root) from the handshake in order to assist in building the chain, but otherwise the Trusted Certificate Authorities "bundle" must contain the root and every subordinate in the chain path.

     

A third and optional validation is revocation status, which would come from a CRL.