Symptoms

SSL handshake failures occur with the backend server revoked certificate in case of reverse proxy.

Impact

Ssl handshake failures due to revoked server certificate

Conditions

1. BIG-IP LTM configured as SSL reverse proxy. 2. revoked-cert-status-response-control set to ignore in the server ssl profile. 3. server certificate authentication set to "require" in the server ssl profile.

Workaround

1. Set the server certificate authentication to ignore in the server ssl profile.

Fix Information

Added checks to validate the certificate as well as the flags set (ignore/drop) for the revoked certificate.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips