The F5 BIG-IP appliance must configure OCSP to ensure revoked machine credentials are prohibited from establishing an allowed session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-260052	F5BI-AP-000233	SV-260052r947419_rule		Medium

Description
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

Description

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

STIG	Date
F5 BIG-IP Access Policy Manager Security Technical Implementation Guide	2024-01-26

Details

Check Text ( C-63783r947377_chk )
If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable. From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Verify an "OCSP Auth" object is configured in the Access Profile for "Machine" type or a CRLDP object is configured. If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked machine credentials are prohibited from establishing an allowed session, this is a finding.

Check Text ( C-63783r947377_chk )

If the BIG-IP appliance does not provide intermediary services for TLS, or application protocols that use TLS (e.g., DNSSEC or HTTPS), this is not applicable.

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Verify an "OCSP Auth" object is configured in the Access Profile for "Machine" type or a CRLDP object is configured.

If the BIG-IP appliance is not configured to use OCSP or CRLDP to ensure revoked machine credentials are prohibited from establishing an allowed session, this is a finding.

Fix Text (F-63698r947418_fix)
If the Access Profile is configured to pull a machine cert using the "Machine Cert Auth" object in the policy, perform the following actions. Note that pulling a Machine Cert requires the use of the APM Edge Client installed on the client. To add OCSP machine certificate verification to an access policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Click the "+" icon on the Successful branch of the Machine Cert Auth object. 6. "Authentication" tab. 7. Select OCSP Auth. 8. Click "Add Item". 9. From the OCSP Responder list, select an OCSP responder. Note: To create an OCSP Responder. go to Access >> Authentication >> OCSP Responder. 10. From the Certificate Type list, select "Machine". 11. Click "Save". 12. Click "Apply Access Policy". To add CRLDP certificate verification to an access policy: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click "Edit" under "Per-Session Policy" for the Access Profile. 5. Click the "+" icon on the Successful branch of the Machine Cert Auth object. 6. "Authentication" tab. 7. Select CRLDP Auth. 8. Click "Add Item". 9. Select an item from the CRLDP Server list. Note: To create a CRLDP Server, go to Access >> Authentication >> CRLDP. 10. Click "Save". 11. Click "Apply Access Policy".

Fix Text (F-63698r947418_fix)

If the Access Profile is configured to pull a machine cert using the "Machine Cert Auth" object in the policy, perform the following actions. Note that pulling a Machine Cert requires the use of the APM Edge Client installed on the client.

To add OCSP machine certificate verification to an access policy:

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Click the "+" icon on the Successful branch of the Machine Cert Auth object.
6. "Authentication" tab.
7. Select OCSP Auth.
8. Click "Add Item".
9. From the OCSP Responder list, select an OCSP responder.
Note: To create an OCSP Responder. go to Access >> Authentication >> OCSP Responder.
10. From the Certificate Type list, select "Machine".
11. Click "Save".
12. Click "Apply Access Policy".

To add CRLDP certificate verification to an access policy:

From the BIG-IP GUI:
1. Access.
2. Profiles/Policies.
3. Access Profiles.
4. Click "Edit" under "Per-Session Policy" for the Access Profile.
5. Click the "+" icon on the Successful branch of the Machine Cert Auth object.
6. "Authentication" tab.
7. Select CRLDP Auth.
8. Click "Add Item".
9. Select an item from the CRLDP Server list.
Note: To create a CRLDP Server, go to Access >> Authentication >> CRLDP.
10. Click "Save".
11. Click "Apply Access Policy".