# OCSP With CRL Fallback **URL:** \ **Category:** Technical Forums\ **Tags:** deployment, irules, security, big-ip-access-policy-manager-apm, devops, application-delivery\ **Created:** [October 29, 2013, 12:55pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214 "2013-10-29T12:55:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![What\_Lies\_Benea](https://avatars.discourse-cdn.com/v4/letter/w/f1d935/32.png) [@What\_Lies\_Benea](https://community.f5.com/u/What_Lies_Benea)\ **Post date:** [October 29, 2013, 12:55pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/1 "2013-10-29T12:55:16Z")
Hi all, I’ve been trying to get my head around OCSP and CRL in a rush. My requirement is relatively simple but without APM (not an option) I’m trying to do this via an iRule. Anyway, the requirement is this; -Use OCSP as the primary method of verifying client certificates (requires an OCSP profile) -Use CRL (not CRLDP) as a fallback should the OCSP responders be unavailable for any reason (requires an SSL profile) According to [this](http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-4-0/14.html), if both are applied (via profiles) then both checks must ‘pass’ not just one or the other, hence the iRule. I’ve found examples of using OCSP in an iRule [here](https://devcentral.f5.com/questions/crl-verification-in-irule), [here](https://devcentral.f5.com/questions?pid=5902) and [here](https://devcentral.f5.com/wiki/iRules.Client-Cert-Request-by-URI-with-OCSP-Checking-v10-1.ashx) (thanks Hoolio) but litle around CRL checking. So, my questions are; -Can I use an iRule to perform the OCSP check and then, if OCSP fails for some reason, switch to an SSL profile that has CRL checking enabled so that CRL checking is performed? -If not, does anyone has any example code for performing a CRL check? -Would it simply be better to use a Pool (or something along these lines) and check it’s up rather than do the OCSP check ‘manually’ in the iRule? ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 29, 2013, 4:41pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/2 "2013-10-29T16:41:44Z")
Can I use an iRule to perform the OCSP check and then, if OCSP fails for some reason, switch to an SSL profile that has CRL checking enabled so that CRL checking is performed? That’s actually a pretty good idea. Here’s what you’d need to make this work: - An internal virtual server, pool, and monitor to load balance the actual remote OCSP resource(s). - An OCSP profile including a responder config that points to the above VIP, and the following iRule (applied directly to the profile). This is a slightly modified version of the built-in _ **\_sys\_auth\_ssl\_ocsp** _ iRule: - Your application virtual server that has a standard client SSL profile (client certificate request/require and trusted authorities cert selected) and the OCSP authentication profile. - A second client SSL profile, identical to the first, but with a static CRL embedded. The OCSP auth iRule simply switches to the other client SSL profile if there are no members in the OCSP pool. You’ll want a good monitor on the OCSP pool, one that potentially makes OCSP calls with known good and revoked certificates. You’ll also need a mechanism to update the static CRL on some regular interval. See: > **[DevCentral](https://community.f5.com/)** > > DevCentral is an online technical community where engineers and practitioners collaborate, share knowledge, and solve problems related to F5 technologies and industry trends. On a side note, it’s actually quite difficult with the (old) auth profile stuff to detect OCSP errors within the iRule, so it tends to be easier and more reliable to stand up a monitor that proactively maintains the state of the remote OCSP resource. ---
**Author:** ![What\_Lies\_Bene1](https://avatars.discourse-cdn.com/v4/letter/w/59ef9b/32.png) [@What\_Lies\_Bene1](https://community.f5.com/u/What_Lies_Bene1)\ **Post date:** [October 29, 2013, 5:42pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/3 "2013-10-29T17:42:36Z")
Thanks Kevin, I’ve already ‘borrowed’ the bash script 😉 I don’t know where you get the time. Interesting that the iRule is applied to the OCSP profile; it hadn’t occurred to me it could be and great it can be! I’ll probably be tweaking/checking tonight and testing tomorrow, I’ll let you (and DC in general) know how it goes. Thanks again. ---
**Author:** ![What\_Lies\_Bene1](https://avatars.discourse-cdn.com/v4/letter/w/59ef9b/32.png) [@What\_Lies\_Bene1](https://community.f5.com/u/What_Lies_Bene1)\ **Post date:** [October 30, 2013, 2:00pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/4 "2013-10-30T14:00:39Z")
Kevin, forgive the dumb question but apart from the part that switches to the CRL enabled SSL profile, why do I actually need the rest of the rule? ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 30, 2013, 2:27pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/5 "2013-10-30T14:27:59Z")
Authentication profiles are triggered by iRules. You’ll notice your system has a set of built-in “\_sys\_auth\_” iRules. These are used with their respective auth profiles to actually trigger the authentication process - generally a call to PAM - and are actually assigned in the auth profile (not in the VIP). The code I’m using is a modification of the required OCSP iRule. ---
**Author:** ![lani93](https://avatars.discourse-cdn.com/v4/letter/l/bbce88/32.png) [@lani93](https://community.f5.com/u/lani93)\ **Post date:** [September 16, 2023, 10:20am UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/6 "2023-09-16T10:20:38Z")
Hello  @Kevin_Stewart am facing the same problematic. what about if there is just a CRL’s URL in the certificate (no AIA ocsp) and the pool is up. how can i fix this scenario ? ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [September 18, 2023, 8:51pm UTC](https://community.f5.com/t/ocsp-with-crl-fallback/26214/7 "2023-09-18T20:51:03Z")
This is a super old thread 😉 So before diving into any options, just need to clarify: the above is for **client cert validation** only. Do you mean that the client cert only has a CRLDP value, and no AIA (OCSP) value?