Bug ID 794417: Modifying enforce-tls-requirements to enabled on the HTTP/2 profile when renegotiation is enabled on the client-ssl profile should cause validation failure but does not

Last Modified: Apr 20, 2021

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,,,,,,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,,, 14.1.2,,,,,,,,, 14.1.3,, 15.0.0, 15.0.1,,,,, 15.1.0,,,,,, 15.1.1, 15.1.2,, 16.0.0,, 16.0.1,

Fixed In:
14.1.4, 13.1.4

Opened: Jun 17, 2019
Severity: 3-Major


On a single virtual server, when 'TLS Renegotiation' is enabled in an associated Client SSL profile, the system should prevent enabling the 'Enforce TLS Requirements' option in the associated HTTP/2 profile.


The configuration will not load if saved.


BIG-IP system validation does not prevent this configuration in the following scenario: 1. Disable the 'Enforce TLS Requirements' option in the HTTP/2 profile. 2. Enable 'TLS Renegotiation' in the Client SSL profile. 3. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile.


If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Client SSL profile(s) on that virtual server.

Fix Information

Added a missing validation check for TLS Renegotiation and Enforce TLS Requirements.

Behavior Change