Bug ID 532911: Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.

Last Modified: Nov 07, 2022

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8

Fixed In:
12.0.0, 11.6.1

Opened: Jul 11, 2015

Severity: 3-Major

Related Article: K03753124

Symptoms

Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.

Impact

The ltm log displays this error: Peer cert verify error: unable to verify the first certificate.

Conditions

In server SSL profiles with 'Untrusted Certificate Response Control' set to ignore. When backend server sends self-signed untrusted certificate.

Workaround

None.

Fix Information

Ignore X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE certificate validation error message when serverssl profile sets 'Untrusted Certificate Response Control' to ignore.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips