brysojl

I would expect a lot of things would not work after a failover if you don't have licenses on the other side. I have seen HA sync issues when upgrading. I have found that if the secondary is set to STAYSECONDARY when certs are installed, the cer/key files will not be there after unsetting STAYSECNDARY and failing over. This would cause a bind failure.

thank you so much, Subhojit! I was reminded that we have a this ATS Profession Services contract...... I created a support case and they are working with on this issue.

I need to move a currently internet facing mTLS VIP behind our CDN. The CDN must terminate the handshake with the originating client and pass the client cert data back to the Netscaler VIP in HTTP headers. I would like to take the certificate data from the headers and then do a certificate revocation check from my Netscaler. Getting the CDN to do the CRL check appears to be beyond their intellectual capacity. I am passing the certificate subjecCN string in an API call using an httpCallout to an application tier for authentication. Thus, I need make the HTTP data and make a CRL call after i complete the handshake with the CDN. Not sure if that is even possible or how to go about it. Any ideas welcome. It's a while since visited the forum. I had to set my account up again. If this should go in a different topic let me know Here are the relevant headers from the CDN X-SSL-Client-I-DN: CN=**********************,DC=******,DC=******,DC=*** X-SSL-Client-S-DN: emailAddress=************,CN=************,OU=**************,OU=*********,O=*****,L=************,ST=**,C=US X-SSL-Client-Verify: FAILED:unable to verify the first certificate X-SSL-Client-Serial: 680**********************************************C X-SSL-Client-V-Remain: 116 X-SSL-Client-V-End: Jun 10 11:49:56 2024 GMT X-SSL-Client-V-Start: Apr 12 11:49:56 2022 GMT X-SSL-Client-Sha1: 299999999999999999999999999921F X-SSL-Client-Cert: -----BEGIN%20CERTIFICATE-----%0AM#########0A-----END%20CERTIFICATE-----%0A

On-prem ADM is not dead. Make sure you set the correct IP and port for the ADM at the VPX. Validate the TCP connectivity or open firewall as needed. Also, i have seen instances where it took what seemed like a long time for the new devices to populate in the ADM GUI. The other guy on my team is more involved with ADM though. I will check in with him as well if don't get it fixed.

You need to enable DEBUG Log Level for Syslog Events from NetScaler CLI