K000137796 : BIG-IP SSL profile security exposure

Security Advisory Description

The BIG-IP system may not honor the revocation status of a certificate present in the certificate revocation list (CRL) file, potentially allowing unauthorized connections.

This issue occurs when all of the following conditions are met:

• A ClientSSL or ServerSSL profile has the Certificate Authentication option enabled.
• A local CRL file is in use.

Impact

The BIG-IP system may incorrectly allow unauthorized connections that have a revoked certificate.

Symptoms

As a result of this issue, you may encounter the following symptom:

• Connections are allowed for clients or servers with revoked certificates.