Online Certificate Status Protocol (OCSP) is a protocol used for validation of x509 certificates in a PKI system. Most OCSP implementations ingest certificate revocation lists (CRLs) from Certificate Authorities (CAs), create an internally signed database called a proof set, and then produce OCSP ...

learn more… | top users | synonyms

0
votes
0answers
20 views

Trust certificate for OCSP, but not for client certs?

According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification: ssl_trusted_certificate / ssl_client_certificate Specifies ...
-2
votes
1answer
54 views

Configuring OCSP stapling in NGINX

Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.
1
vote
1answer
25 views

OCSP Stapling on LAMP with Let's Encrypt

How do I verify if OCSP Stapling works correctly? Setup: LAMP with Let's Encrypt, test domain https://pavelstriz.cz/ High-Tech Bridge result says OCSP is enabled Is this enough for me to believe ...
3
votes
1answer
123 views

Nginx letsencrypt OCSP stappling

I have set up nginx with SSL and letsencrypt certificates. However I am unable to get OCSP stappling to work. From what I found in the web, it should work with the following configuration, ...
0
votes
1answer
108 views

Nginx, SSL and OSCP

I have a problem. When I open my website with https, I see error message in my error.log: 2015/11/03 19:47:21 [error] 7799#0: recv() failed (111: Connection refused) while requesting certificate ...
0
votes
1answer
230 views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
4
votes
2answers
658 views

OCSP server suggests trying again later

I am using Firefox to access my site secured with a free StartSSL certificate. I am sending an HSTS header (though now for testing I have it set to 15 seconds!) and I have enabled OCSP stapling. ...
11
votes
1answer
2k views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an OCSP....
0
votes
1answer
280 views

IIS ocsp stapling - no response

I have a certificate that is configured in IIS in windows server 2012 with ocsp_uri. When I test the server for oscp stapling there is no response: openssl s_client -connect example.com:443 -tls1 -...
-1
votes
1answer
280 views

Problem with TLS identity not verified

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
2answers
125 views

How to Configure Windows Certificate Services not to use AIA and CRL when issuing Certificates

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is ...
4
votes
1answer
224 views

How to get OpenSSH to use OCSP for revocation

As the title says, is there any (free) library, patch, etc. that allows OpenSSH to be configured to check x.509 certificate revocation via OCSP (online certificate status protocol)? If so, can you ...
12
votes
2answers
11k views

OCSP validation - unable to get local issuer certificate

I'm new to setup SSL from the scratch and did my first steps. I bought a SSL cert from RapidSSL for my domain and followed there steps to install the cert. In general the cert is valid and working on ...
1
vote
1answer
205 views

Adding OCSP and NDES into existing environment? What can be installed together?

Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP. I know the web enrollment can be installed on the Issuing ...
1
vote
0answers
1k views

Apache stapling_renew_response: responder error

My Apache error log shows a lot of " stapling_renew_response: responder " errors. Was hoping to add a browser screenshot but I'm a newbie and therefore not authorised. This is what is shown from the ...
16
votes
4answers
15k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
0
votes
1answer
391 views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
1answer
207 views

Remove specified OCSP responder from certificate

OCSP is brain-damaged and a privacy violation. Is there a way I can remove the specified OCSP responder from a certificate file to prevent my site's visitors from having to suffer it? From what I ...
5
votes
1answer
778 views

Are there certain specific host file entries that Windows 2008 will ignore for security purposes?

While troubleshooting a network timeout/connectivity WinHTTP issue, I temporarily added a host file entry for: 127.0.0.1 ctldl.windowsupdate.com (The server has no internet connection and the ...
5
votes
1answer
711 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1answer
306 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...
2
votes
1answer
551 views

When are OCSP requests sent by web browsers?

I'm testing my https page via webpagespeedtest on IE8, and in one run I noticed a bunch of OSCP requests sent to oscp.godaddy.com. I never noticed any such requests in previous runs. When do browsers ...
0
votes
1answer
220 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
1
vote
1answer
225 views

Considerations for certificate revocation for intermittently isolated ad-hoc networks

I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. I'...
14
votes
0answers
7k views

OpenSSL: how to setup an OCSP server for checking third-party certificates?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation ...
11
votes
2answers
5k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?