CirrostratusI am wondering, Why we check client certificate using CRL? or OCSP? Since i am holding the Public Certicate and private ket in my f5 box? Client are just accessing my website? How client certificate if compromised , it will breach my web server security?
CirrocumulusYou just use that to check if the certificate still valid or not. If you are not doing client authentication, there is nothing to check.
Check this articles, as it has diagrams showing the different types of SSL handshake.
https://devcentral.f5.com/articles/ssl-profiles-part-1
On the other hand, the client itself (most likely a browser), will use some kind of validation to check that the certificate still valid, can be one of those methods or not.