Forum Discussion

SMilanic's avatar
SMilanic
Icon for Cirrus rankCirrus
Mar 06, 2024
Solved

Dynamic CRL Check with Client SSL Profile - How to notify the user?

Hi,    we have implemented dynamic CRL checking with client SSL profile in our test environment with BIG-IP 15.1.  And it works. If a test user tries to establish a SSL session to a VIP with dynam...
crl
crldp
LTM
ssl
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Apr 09, 2024

    Spit-balling here, but do you have Client Certificate auth set to Request or Require? The latter will terminate the session if validation fails. The former will not.

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee

Spit-balling here, but do you have Client Certificate auth set to Request or Require? The latter will terminate the session if validation fails. The former will not.

SMilanic's avatar
SMilanic
Icon for Cirrus rankCirrus
Apr 09, 2024

Hi Kevin, 

Yes, in fact, setting the Client cert auth to "Request" instead of "Require" solved the problem. 

When the Client cert auth is set to "Request", we can catch the result in an iRule and redirect the client's browser to an error page.