WAF and EJBCA for CMP protocol

[syisunny]

Hello,
I’m seeking your advice and experience regarding setting up a Web Application Firewall (WAF) in front of EJBCA to support the CMP protocol.
The WAF is based on ModSecurity with the Core Rule Set (CRS) enabled. However, we’re encountering an issue where CMP protocol requests are being rejected by the WAF. Since these requests include binary data for certificates, the WAF flags them as potential threats, such as SQL injection, remote command execution, and other malicious activity.
Do you have any suggestions for configuring the WAF in this scenario? Specifically, we’re looking for best practices or rule adjustments to allow legitimate CMP traffic while maintaining security.
for the WAF, we could configure the paranoia level, remove some security rules by id/tag...
Thank you in advance!
Best regards,