Symptoms

Clicking the 'Fix Automatically' button in the PCI Compliance page does not replace the insecure client SSL profile attached on an HTTP/2 virtual server, with a secure one. The compliance state shows as a red cross mark, indicating the virtual server to be noncompliant.

Impact

The provision for enhanced configuring does not function as expected for HTTP/2-based virtual servers.

Conditions

-- Clicking the 'Fix Automatically' button on the PCI compliance page. -- A noncompliant PCI profile is attached to the HTTP/2 virtual server. -- A PCI-compliant, client SSL profile with renegotiation disabled is available in the SSL profiles.

Workaround

Manually configure a PCI-compliant profile in SSL profiles, with renegotiation disabled, and attach it to the virtual server.

Fix Information

HTTP/2 virtual servers are now handled correctly on the PCI Compliance page.

Behavior Change