Bug ID 532911: Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.

Last Modified: Oct 16, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.6.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2

Fixed In:
12.0.0, 11.6.1

Opened: Jul 11, 2015

Severity: 3-Major

Related Article: K03753124

Symptoms

Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.

Impact

The ltm log displays this error: Peer cert verify error: unable to verify the first certificate.

Conditions

In server SSL profiles with 'Untrusted Certificate Response Control' set to ignore. When backend server sends self-signed untrusted certificate.

Workaround

None.

Fix Information

Ignore X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE certificate validation error message when serverssl profile sets 'Untrusted Certificate Response Control' to ignore.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips