Administrator Guide

NOTE: If you have an IPv6 address in the URL, then enclose this address in square brackets. For example, http://
[1100::203]:6514.
Conguring OCSP behavior
You can congure how the OCSP requests and responses are signed when the CA or the device contacts the OCSP responders.
To congure this behavior, follow this step:
In CONFIGURATION mode, enter the following command:
crypto x509 ocsp {[nonce] [sign-request]}
Both the none and sign-request parameters are optional. The default behavior is to not use these two options. If your OCSP
responder uses pre-computed responses, you cannot use the none feature in the switch's communcations with the responder. If your
OCSP responder requires signed requests, you can use the sign-requests option.
Conguring Revocation Behavior
You can congure the system behavior if an OCSP responder fails.
By default, when all the OCSP responders fail to send a response to an OSCP request, the system accepts the certicate and logs the
event. However, you can congure the system to reject the certicate in case OCSP responders fail.
To congure OCSP revocation settings:
In CONFIGURATION mode, enter the following command:
crypto x509 revocation ocsp [accept | reject]
The default behavior is to accept certicates if either an OCSP responder is unavailable or if no responder is identied.
Conguring OSCP responder preference
You can congure the preference or order that the CA or a device follows while contacting multiple OCSP responders.
Enter the following command in Certicate mode:
ocsp-server prefer
Verifying certicates
A CA certicate’s public key is used to decrypt a presented certicate’s signature to obtain a hash value.
The rest of the presented certicate is also hashed and if the two hashes match then the certicate is considered valid.
During verication, the system checks the presented certicates for revocation information. The system also enables you to congure
behavior in case a certicate’s revocation status cannot be veried; for example, when the OCSP responder is unreachable you can alter
system behavior to accept or reject the certicate depending on conguration. The default behavior is to accept the certicates. The
system also logs the events where the OSCP responders fail or invalid OSCP responses are received.
NOTE
: A CA certicate can also be
revoked.
X.509v3 1031