User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
150
OCSP Cache Learning
The OCSP cache learning function ( AutoLearningEnabled: Y )
can be used to limit which certificates will be considered for
validation, as follows:
NOTE: Adminis-
tratively added
OCSP cache entries per-
mit the corresponding
certificate to be consid-
ered for validation even
when the entry’s
Status
is Not yet validated .
When OCSP cache learning is enabled, every certificate
presented to the internal authentication server for validation will
be processed. If the revocation status of the certificate can be
successfully determined by contacting the configured OCSP
responder, an entry for the certificate will be added to the
cache—or, if an entry already exists for the certificate, it will be
updated or refreshed in the cache.
When cache learning is disabled (
AutoLearningEnabled: N ),
not all certificates presented to the internal authentication
server for validation will be processed. Only certificates that
match an entry already present in the cache will be considered
for validation. Other certificates will be rejected without further
processing.
Three
set localauth options configure the Mesh Point’s
OCSP function globally:
EnableOcsp[N] (Y|N to enable|disable OCSP):
OcspUrl[""] (URL of OCSP responder):
EnableOcspNonce[Y] (Y|N to enable|disable OCSP nonce):
Turn the OCSP client function on (Y) and off (N, the default)
with
EnableOcsp. If you enable OCSP client functionality, you
must configure the OCSP responder URL (
OcspUrl ). Specify
the full global web address, as a domain name or IP address,
of the server that will process the Mesh Point's OCSP requests.
By default, OCSP requests from the internal authentication
server contain the nonce extension (
EnableOcspNonce: Y ).
Alternatively, the nonce extension can be omitted
(
EnableOcspNonce: N ).
4.5.2.6 OCSP Cache Settings and Management
When OCSP is enabled, use
show ocspcache to observe
global OCSP cache settings and any cache entries:
# show ocspcache
OCSP Cache (ValidityPeriod: 168 hours, AutoLearningEnabled: Y, TotalEntries: 0)
Index Common Name Search Text Status
------ ------------------- ------------------- -----------------
No entries to show
ValidityPeriod specifies the length of time, in hours, for
which OCSP cache entries are renewed, upon receipt of a
validation status of Good from the configured OCSP responder,
or when the entry is manually renewed. The default
ValidityPeriod is 168 hours (seven days).