Error: OneClick login denied due to CRL check while CAC is enabled - DX NetOps Spectrum

Products

• Network Observability
• Spectrum

Issue/Introduction

Common Access Card (CAC) authentication fails in OneClick when a proxy (such as an F5 Load Balancer) repackages client certificates without Certificate Revocation List (CRL) information. Users receive a login denial because OneClick cannot verify the revocation status.

Symptoms:

• Users are unable to log in to OneClick using CAC.
• The catalina.out or CAC debug logs show errors indicating "Unable to determine revocation status" or "No CRL loaded for Issuer."
• Setting crl-enabled="false" in cac-system-config.xml does not resolve the issue and may prevent all CAC logins.

Environment

• Product: DX NetOps Spectrum OneClick
• Version: All supported versions
• Component: CAC Authentication / SSL
• Configuration: OneClick behind an F5 or similar intercepting proxy performing "break and inspect" on certificates.

Cause

The Spectrum OneClick Revocation System is an integrated, mandatory component of the CAC authentication module. When CAC is enabled, the system requires a valid revocation source (OCSP AIA, OCSP Server, or CRL).

There is no independent toggle to disable revocation checking while keeping CAC active, as the underlying Java PKIX validator defaults to revocation checking enabled. Regardless of the XML file configuration for <crl-enabled> it is ignored.

Resolution

Engineering will be resolving this in the 25.4.11 release (ETA, subject to change) through defect DE209729. Watch the Fault Monitoring Resolved Issues list for 25.4.11, when released, for an entry referencing DE209729 to confirm it's inclusion.

The tool will honor the XML configurations that show <crl-enabled> being set to false vs true.

Additional Information

• To be updated on any future changes to this behavior, please subscribe to this article.
• For assistance with F5 certificate re-packaging, consult your F5 administrator.
• To speak with a Support Engineer, see Contact Support.