Bug ID 1008017: Validation failure on Enforce TLS Requirements and TLS Renegotiation

Last Modified: Feb 07, 2024

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
16.1.1, 16.1.0, 16.0.1.2, 15.1.5, 15.1.4, 15.1.3.1, 15.1.3, 14.1.4.4, 14.1.4.3, 14.1.4.2, 14.1.4.1, 14.1.4, 13.1.4.1, 13.1.4

Fixed In:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5

Opened: Mar 31, 2021

Severity: 3-Major

Symptoms

The configuration load fails with an error: err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.

Impact

The configuration will not load if saved.

Conditions

BIG-IP system allows this configuration and fails later: -- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled). 1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled). 2. Add server SSL profile with 'TLS Renegotiation' enabled. 3. Save the configuration. 4. Load the configuration.

Workaround

If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.

Fix Information

There is now a validation check to prevent this configuration, which is the correct functionality.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips