OCSP health monitor

Question

Hey Guys,&nbsp;
Sort of in a time crunch. I am looking for a way to create a health monitor the would monitor OCSP request instead of http/https. I've seen/read somewhere on the forums that is could be by an external script ? but not sure how that would be done.&nbsp;
I have a pool of OCSP validators which work for http health monitor but that's not what our sec team is looking to get monitored.&nbsp;
Any help is appreciated.&nbsp;
Thanks&nbsp;

ian_mahuron_383 · Answer

Try 'openssl ocsp' (man ocsp). This is a full-fledged OCSP validator and responder. Once you get it working from the command line, adapt the commands for use as an external monitor. Keep in mind that external monitors are expensive (they fork new processes) and should be used sparingly.

bigipjr28_13978 · Answer

great thanks for your reply..In order to implement this I am going to have to use an external monitor. Would anyone one know how to use add or mimick the recieve string in a script is looking for an HTTP 1.1 200 OK as a response ?

bigipjr28_13978 · Answer

Thanks again. As of now to two ocsp nodes are on the gtm as a server object.  With a wideip name that has the pool of nodes on the gtm. Would this work on the gtm ? I upload the the certs that are being used against the argurments as well as the external monitor.

Here is what my external script looks like on the GTM:

!/bin/bash

cmd for ocsp responder

openssl ocsp -url http://ocsp.staging.com -VAfile  prodsigner.pem -issuer cetmanager.pem -cert good.pem Response verify OK

exit 0

Thanks again

ian_mahuron_383 · Answer

Assuming they operate in a fashion similar to bigip external monitors, _any_ output indicates the monitor succeeded.  Silence indicates failure.  I suspect you'll need a "| grep 'Response verify OK'" to accomplish this.

bigipjr28_13978 · Answer

The setup for the ocsp nodes is that we have them as server objects on the GTM devices. I have imported certificates to run again the openssl ocsp command but the command still fails ? Is it possible to use the certificates on the GTMS ?. Do you have to use the full path to where there certificates resides /config/filestore/files_d/

Forum Discussion

OCSP health monitor

7 Replies

Recent Discussions

Port Group on F5OS network setting

Advise on setting up IRULE

F5 iRule to replace host to path

google-visualization-issues

google autenticator broken barcode

Related Content

Health monitor question

F5 Distributed Cloud - Regional Edge Health Monitoring Insights

iRule based RADIUS Health Monitor Builder

GTM health Monitoring and Probe

Losing Requests because of health monitoring