![]() ![]() ![]() ![]() |
Domain: Security: Certificate Revocation Checking: Certificate Authority Override: Configuration: OCSP
This page allows you to configure the OCSP (Online Certificate Status Protocol) properties of this SSL certificate revocation checking certificate authority override.
Configuration Options
Name Description Enable Nonce For this CA, determines whether a nonce is sent with OCSP requests, to force a fresh (not pre-signed) response.
MBean Attribute:
CertRevocCaMBean.OcspNonceEnabled
Enable Response Cache For this CA, determines whether the OCSP response local cache is enabled.
MBean Attribute:
CertRevocCaMBean.OcspResponseCacheEnabled
Response Timeout (seconds) For this CA, determines the timeout for the OCSP response, expressed in seconds.
The valid range is 1 thru 300 seconds.
MBean Attribute:
CertRevocCaMBean.OcspResponseTimeout
Minimum value:
1
Maximum value:
300
Time Tolerance (seconds) For this CA, determines the time tolerance value for handling clock-skew differences between clients and responders, expressed in seconds.
The validity period of the response is extended both into the future and into the past by the specified amount of time, effectively widening the validity interval.
The value is >=0 and <=900. The maximum allowed tolerance is 15 minutes.
MBean Attribute:
CertRevocCaMBean.OcspTimeTolerance
Minimum value:
0
Maximum value:
900
Responder URL For this CA, determines the OCSP responder URL to use as failover or override for the URL found in the certificate AIA. The usage is determined by
getOcspResponderUrlUsage
.MBean Attribute:
CertRevocCaMBean.OcspResponderUrl
Responder URL Usage For this CA, determines how
getOcspResponderUrl
is used: as failover in case the URL in the certificate AIA is invalid or not found, or as a value overriding the URL found in the certificate AIA.MBean Attribute:
CertRevocCaMBean.OcspResponderUrlUsage
OCSP Responder Explicit Trust Method For this CA, determines whether the OCSP Explicit Trust model is enabled and how the trusted certificate is specified.
The valid values:
- "NONE"
Explicit Trust is disabled
- "USE_SUBJECT"
Identify the trusted certificate using the subject DN specified in the attribute
OcspResponderCertSubjectName
.- "USE_ISSUER_SERIAL_NUMBER"
Identify the trusted certificate using the issuer DN and certificate serial number specified in the attributes
OcspResponderCertIssuerName
andOcspResponderCertSerialNumber
, respectively.MBean Attribute:
CertRevocCaMBean.OcspResponderExplicitTrustMethod
Subject Name For this CA, determines the explicitly trusted OCSP responder certificate subject name, when the attribute returned by
getOcspResponderExplicitTrustMethod
is "USE_SUBJECT".The subject name is formatted as a distinguished name per RFC 2253, for example "CN=CertGenCAB, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MyState, C=US".
In cases where the subject name alone is not sufficient to uniquely identify the certificate, then both the
OcspResponderCertIssuerName
andOcspResponderCertSerialNumber
may be used instead.MBean Attribute:
CertRevocCaMBean.OcspResponderCertSubjectName
Issuer Name For this CA, determines the explicitly trusted OCSP responder certificate issuer name, when the attribute returned by
getOcspResponderExplicitTrustMethod
is "USE_ISSUER_SERIAL_NUMBER".The issuer name is formatted as a distinguished name per RFC 2253, for example "CN=CertGenCAB, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MyState, C=US".
When
OcspResponderCertIssuerName
returns a non-null value then theOcspResponderCertSerialNumber
must also be set.MBean Attribute:
CertRevocCaMBean.OcspResponderCertIssuerName
Serial Number For this CA, determines the explicitly trusted OCSP responder certificate serial number, when the attribute returned by
getOcspResponderExplicitTrustMethod
is "USE_ISSUER_SERIAL_NUMBER".The serial number is formatted as a hexidecimal string, with optional colon or space separators, for example "2A:FF:00".
When
OcspResponderCertSerialNumber
returns a non-null value then theOcspResponderCertIssuerName
must also be set.MBean Attribute:
CertRevocCaMBean.OcspResponderCertSerialNumber
![]() |