Questions tagged [ocsp]

Online Certificate Status Protocol (OCSP) is a protocol used for validation of x509 certificates in a PKI system. Most OCSP implementations ingest certificate revocation lists (CRLs) from Certificate Authorities (CAs), create an internally signed database called a proof set, and then produce OCSP using the proofs.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

How can I make nginx only look for ipv4 resolution for OCSP? Or have I misinterpreted the point of failure?

I've set OCSP up, but see lots of resolver timed out errors in my logs: ocsp.sectigo.com could not be resolved (110: Operation timed out) while requesting certificate status, responder: ocsp.sectigo....
0
votes
0answers
37 views

Enterprise Issuing CA denied bind by domain controller

I am setting up a test environment and have a standalone Root CA and an Enterprise Intermediate CA as my issuing. On a third server, I set up an OCSP responder. The OCSP server and the Issuing CA are ...
1
vote
0answers
53 views

OCSP responder on a virtual host of Apache/Nginx

Is it possible to run an OCSP responder openssl ocsp -index ... on an Apache/Nginx virtual host alongside other virtual hosts? So ocsp.example.com or pki.example.com/ocsp/
0
votes
0answers
20 views

how to remove the optional “next update” field in ocsp response

How can I change/remove the OSCP "next update" field extension from response. I need my client to always contact the OSCP server ,instead of using cache based on next update time. I am using ...
0
votes
0answers
45 views

OCSP setup for Vault

I have vault setup running in container for PKI Secrets Engine and would like to add OCSP support for application to check if certificate is not revoked. I didn’t find any explanation on how to setup ...
0
votes
2answers
256 views

How to check if a letsencrypt certificate has been revoked

I am trying to check if a certificate issued by letsencrypt has been revoked based on this answer: openssl ocsp -issuer highschoolhelper.org_fullchain.crt -cert highschoolhelper.org_fullchain.crt \...
0
votes
0answers
22 views

Enable OCSP Stapling on pureftpd

I have googled for hours to no avail: couldn't find a single reference regarding the proper way to enable OCSP Stapling on pure-ftpd. Server running on Ubuntu 18.04.4 LTS
0
votes
1answer
100 views

Apache httpd: How to enable OCSP stapling with mod_md?

I want to enable OCSP stapling with mod_md on my Debian 10 server with Apache httpd. I have enabled the module, and the command MDomain example.org is understood, but the example <MDomain mydomain....
1
vote
1answer
48 views

ADCS PKI - AIA Location when using OCSP

My question is wheter or not I still need to configure the following AIA location on my subordinate CA when I'm using OCSP: http://SERVERFQN/DIRECTORY/<Serverdnsname>_<Caname><...
1
vote
1answer
362 views

“Next Update” is missing from the OCSP response

Overall I am experimenting to set up a private PKI by using OpenSSL on a box of CentOS 7. Everything works just fine except the issue that the "Next Update" line is missing from the OCSP response. ...
1
vote
1answer
1k views

OCSP Location error in pkiview.msc. But OCSP responders seem to work

I am currently setting up a new internal Windows PKI infrastructure in our organisation, to replace an old setup. Things are mostly fine, but the OCSP location has the status "Error" in the pkiview ...
0
votes
1answer
301 views

OCSP client certificate validation

For a home automation project I have created an API (written in ASP.NET so hosted in IIS) and written my own Android app to communicate with this API. To prevent people from accessing specific ...
0
votes
1answer
1k views

Why am I unable to make OCSP Stapling work with my nginx, libressl on FreeBSD 12.0-STABLE setup?

After hours of trying I have to get help for my issue. I am trying to get OCSP stapling to work with my setup, but am not successful in doing so. Here is my nginx configuration, without any non-...
0
votes
1answer
1k views

Best approach to tier 2 PKI with multiple subordinates with ADCS

I'm looking for some guidelines toward the best approach to setting up a Tier 2 PKI with ADCS that has 2 subordinate CA's for high availability. I have the following questions regarding this: Is ...
2
votes
1answer
688 views

Using Apache as Stunnel

I was using stunnel to make an http port into https. However, it doesn't support OCSP stapling, so I decided to use Apache reverse proxy instead. The service I want to make https is on 7231, so I ...
0
votes
1answer
352 views

How to build an OCSP certificate chain for dual-stack RSA + ECC certificates

Nginx lets us use multiple certificates so that we can use both ECC and RSA certificates ssl_certificate /etc/ssl/example.com.combined.crt; ssl_certificate_key /etc/ssl/example.com.key; ...
0
votes
1answer
229 views

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
0
votes
1answer
455 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
1
vote
1answer
1k views

nginx OCSP stapling centos let's encrypt

On centos, but I guess for every OS, I want to make ocsp stapling work in Nginx ssl_stapling on; ssl_trusted_certificate ??????; ssl_stapling_verify on; what do I define for ...
0
votes
0answers
26 views

What happens when a CN or Alternative Name in a SAN or UCC ssl certificate no longer resolves to the server?

What happens when a CN or Alternative Name in a SAN or UCC ssl certificate no longer resolves to the server? Are there any problems that can arise from this? The question is general but the ...
1
vote
1answer
934 views

OCSP verification fails in Strongswan (IKEv2)

I've managed to set up an IPsec connection between two (virtual) hosts in transport mode and now I want the server to validate the client's certificate with OCSP. In a third host, I've run an OCSP ...
2
votes
0answers
4k views

OCSP responder timed out while requesting certificate status

I'm intermittently seeing errors such as the following in my nginx error logs: OCSP responder timed out (110: Connection timed out) while requesting certificate status, responder: ocsp.comodoca.com ...
4
votes
1answer
6k views

Online Certificate Status Protocol (OCSP) and Port 80

I had used OCSP stapling in AWS in the past, due to changes on AWS they no longer allow this. This has resulted in having to open a firewall rule to allow outbound HTTP traffic for OCSP from client ...
0
votes
1answer
215 views

OCSP Stapling for Thawte certificates does not work

OCSP Stapling does not work for Thawte certificates on Nginx, what could be the problem? Configured Nginx to work with OCSP Stapling. ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate ...
12
votes
2answers
4k views

nginx: ssl_stapling_verify: What exactly is being verified?

What exactly does the ssl_stapling_verify directive? Does it check if the signature of the answer is correct? The official nginx documentation is very vague in explaining this: https://nginx.org/en/...
10
votes
1answer
3k views

Do Postfix and Dovecot support OCSP stapling?

Since I would like to set the "must staple" attribute in my SSL certificates, I was doing some research to find out if all of my services support OCSP stapling. So far I found out, that Apache does ...
6
votes
1answer
2k views

Can I make Nginx automatically OCSP staple certificates at reload/restart?

Is there a way to make Nginx proactively OCSP staple certificates each time its configuration is reloaded or it is re-started? Alternatively, can Nginx be set to save the stapled certificates across ...
3
votes
1answer
3k views

OCSP with nginx is unable to get issuer certificate

I am having trouble setting up OCSP on nginx/1.6.2 with a certificate issued by GlobalSign. I read many related posts, but none of the solutions I've found worked. When I connect to the server, OCSP ...
6
votes
2answers
4k views

Enabling OCSP stapling on IIS SNI-enabled site

If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site. This is easily confirmed by enabling SNI for a site that currently doesn't require ...
2
votes
0answers
141 views

Trust certificate for OCSP, but not for client certs?

According to the nginx docs, you can specify certificates to be trusted for both OCSP response and client certificate verification: ssl_trusted_certificate / ssl_client_certificate Specifies a ...
-2
votes
1answer
241 views

Configuring OCSP stapling in NGINX

Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.
1
vote
1answer
114 views

OCSP Stapling on LAMP with Let's Encrypt

How do I verify if OCSP Stapling works correctly? Setup: LAMP with Let's Encrypt, test domain https://pavelstriz.cz/ High-Tech Bridge result says OCSP is enabled Is this enough for me to believe ...
6
votes
2answers
1k views

Nginx letsencrypt OCSP stappling

I have set up nginx with SSL and letsencrypt certificates. However I am unable to get OCSP stappling to work. From what I found in the web, it should work with the following configuration, ...
2
votes
1answer
770 views

Nginx, SSL and OSCP

I have a problem. When I open my website with https, I see error message in my error.log: 2015/11/03 19:47:21 [error] 7799#0: recv() failed (111: Connection refused) while requesting certificate ...
2
votes
1answer
2k views

OCSP ERROR in ssllabs output

I just renewed my certificate on https://wemarsh.com/ . After I thought I had everything working I did some online SSL tests, just as a routine check that everything is configured properly. Some of ...
5
votes
2answers
5k views

OCSP server suggests trying again later

I am using Firefox to access my site secured with a free StartSSL certificate. I am sending an HSTS header (though now for testing I have it set to 15 seconds!) and I have enabled OCSP stapling. ...
13
votes
1answer
6k views

OCSP responder not present?

Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an OCSP....
1
vote
1answer
1k views

IIS ocsp stapling - no response

I have a certificate that is configured in IIS in windows server 2012 with ocsp_uri. When I test the server for oscp stapling there is no response: openssl s_client -connect example.com:443 -tls1 -...
-1
votes
1answer
333 views

Problem with TLS identity not verified

I run a CA server "Microsoft CA Server Enterprise" and I generate certificates then bind the cert to my site. In all clients in my network, I add the cert with certutil -addstore ca org.cer When my ...
0
votes
2answers
338 views

How to Configure Windows Certificate Services not to use AIA and CRL when issuing Certificates

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is ...
4
votes
1answer
912 views

How to get OpenSSH to use OCSP for revocation

As the title says, is there any (free) library, patch, etc. that allows OpenSSH to be configured to check x.509 certificate revocation via OCSP (online certificate status protocol)? If so, can you ...
17
votes
2answers
31k views

OCSP validation - unable to get local issuer certificate

I'm new to setup SSL from the scratch and did my first steps. I bought a SSL cert from RapidSSL for my domain and followed there steps to install the cert. In general the cert is valid and working on ...
1
vote
1answer
595 views

Adding OCSP and NDES into existing environment? What can be installed together?

Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP. I know the web enrollment can be installed on the Issuing ...
4
votes
0answers
6k views

Apache stapling_renew_response: responder error

My Apache error log shows a lot of " stapling_renew_response: responder " errors. Was hoping to add a browser screenshot but I'm a newbie and therefore not authorised. This is what is shown from the ...
26
votes
4answers
34k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
0
votes
1answer
1k views

How do I set up an OCSP responder for multiple CA certificates?

I want to have one OCSP responder for more than one intermediate CA issuers with OpenSSL. How would I do this? All the examples I see all respond only for one issuer certificate and one OCSP signing ...
0
votes
1answer
539 views

Remove specified OCSP responder from certificate

OCSP is brain-damaged and a privacy violation. Is there a way I can remove the specified OCSP responder from a certificate file to prevent my site's visitors from having to suffer it? From what I ...
6
votes
1answer
1k views

Are there certain specific host file entries that Windows 2008 will ignore for security purposes?

While troubleshooting a network timeout/connectivity WinHTTP issue, I temporarily added a host file entry for: 127.0.0.1 ctldl.windowsupdate.com (The server has no internet connection and the ...
6
votes
1answer
1k views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1answer
448 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...