Bug ID 1008017: Validation failure on Enforce TLS Requirements and TLS Renegotiation

Last Modified: May 29, 2024

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
16.1.1, 16.1.0,, 15.1.5, 15.1.4,, 15.1.3,,,,, 14.1.4,, 13.1.4

Fixed In:
17.0.0, 16.1.2,,, 13.1.5

Opened: Mar 31, 2021

Severity: 3-Major


The configuration load fails with an error: err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.


The configuration will not load if saved.


BIG-IP system allows this configuration and fails later: -- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled). 1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled). 2. Add server SSL profile with 'TLS Renegotiation' enabled. 3. Save the configuration. 4. Load the configuration.


If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.

Fix Information

There is now a validation check to prevent this configuration, which is the correct functionality.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips