Bug ID 1007505: TLS handshake times out if intermediate CA cert status cannot be determined

Last Modified: May 29, 2024

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
14.1.4.2, 14.1.4.1, 14.1.4

Fixed In:
14.1.4.3

Opened: Mar 30, 2021

Severity: 2-Critical

Symptoms

The BIG-IP system resets an HTTPS connection. SSL handshake failure logs appear in /var/log/ltm: warning tmm1[2555]: 01260013:4: SSL Handshake failed for TCP 10.0.0.l0:443 -> 10.0.0.20:60716 In the server-side packet trace, there is no Client Key Exchange message in response to the Server Hello Done message. The connection then is reset 10 seconds after the Server Hello Done message.

Impact

Clients cannot connect to the HTTPS pool members.

Conditions

-- OCSP is configured for the server SSL profile. -- The OCSP responder cannot determine the intermediate CA cert status.

Workaround

For each affected host, add the certificate of the issuer of the server certificate to the CA bundle specified in the Trusted CA field of the server SSL profile.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips