Configuring OCSP Publishing

Overview

This page describes the process to configure the CA to publish the CRL to the OCSP responder.

Configuring OCSP Publishing

The OCSP publishing configuration is stored in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.

To configure OCSP publisher:

ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.enableClientAuth=true
ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.host=pki.example.com
ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.nickName=subsystem
ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.path=/ocsp/agent/ocsp/addCRL
ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.pluginName=OCSPPublisher
ca.publish.publisher.instance.OCSPPublisher-pki-example-com-8443.port=8443

To configure CRL publishing rule:

ca.publish.rule.instance.ocsprule-pki-example-com-8443.enable=true
ca.publish.rule.instance.ocsprule-pki-example-com-8443.mapper=NoMap
ca.publish.rule.instance.ocsprule-pki-example-com-8443.pluginName=Rule
ca.publish.rule.instance.ocsprule-pki-example-com-8443.publisher=OCSPPublisher-pki-example-com-8443
ca.publish.rule.instance.ocsprule-pki-example-com-8443.type=crl

To enable CRL publishing:

ca.publish.enable=true

To simplify testing, the buffer size for revocation checking can be set to 0 so that each certificate revocation will take effect immediately:

auths.revocationChecking.bufferSize=0

Also by default the CRL is only updated at scheduled times. To update the CRL immediately on each certificate revocation:

ca.crl.MasterCRL.alwaysUpdate=true

Finally, restart the server.

Verification

To check certificate status:

$ OCSPClient \
    -d ~/.dogtag/pki-tomcat/ca/alias \
    -h $HOSTNAME \
    -p 8080 \
    -t /ocsp/ee/ocsp \
    -c ca_signing \
    --serial 6
CertID.serialNumber=6
CertStatus=Good