The F5 BIG-IP appliance must configure certificate path validation to ensure revoked user credentials are prohibited from establishing an allowed session.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-266165	SRG-NET-000164-ALG-000100	F5BI-AP-300154	SV-266165r1024396_rule	2024-09-20	1

Description
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

Description

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

ℹ️ Check
If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable. Access Policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Verify an "OCSP Auth" object is configured in the Access Profile for "User" type or a CRLDP object is configured. If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked user credentials are prohibited from establishing an allowed session, this is a finding.

ℹ️ Check

If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable. Access Policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Verify an "OCSP Auth" object is configured in the Access Profile for "User" type or a CRLDP object is configured. If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked user credentials are prohibited from establishing an allowed session, this is a finding.

✔️ Fix
Access Policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Add an "OCSP Auth" with certificate type of "User" and/or a "CRLDP Auth" object in the Access Profile. Note: To create an OCSP Responder, go to Access >> Authentication >> OCSP Responder. Note: To create a CRLDP Server object, go to Access >> Authentication >> CRLDP. 6. Add an "OCSP Auth" object in the Access Profile and select an OCSP Responder. 7. Click "Update".

✔️ Fix

Access Policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Add an "OCSP Auth" with certificate type of "User" and/or a "CRLDP Auth" object in the Access Profile. Note: To create an OCSP Responder, go to Access >> Authentication >> OCSP Responder. Note: To create a CRLDP Server object, go to Access >> Authentication >> CRLDP. 6. Add an "OCSP Auth" object in the Access Profile and select an OCSP Responder. 7. Click "Update".