Bug ID 1008017: Validation failure on Enforce TLS Requirements and TLS Renegotiation

Last Modified: Jul 27, 2021

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
14.1.0,,,,,, 14.1.2,,,,,,,,, 14.1.3,, 14.1.4,,,, 15.0.0, 15.0.1,,,,, 15.1.0,,,,,, 15.1.1, 15.1.2,, 15.1.3,, 16.0.0,, 16.0.1,,, 16.1.0

Opened: Mar 31, 2021
Severity: 3-Major


The configuration load fails with an error: err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.


The configuration will not load if saved.


BIG-IP system allows this configuration and fails later: -- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled). 1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled). 2. Add server SSL profile with 'TLS Renegotiation' enabled. 3. Save the configuration. 4. Load the configuration.


If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.

Fix Information


Behavior Change