Online Certificate Status Protocol Responder; About Ocsp Services; Ocsp Response Signing - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Chapter 6.
Online Certificate Status Protocol
Responder
This chapter provides an overview of an Online Certificate Status Protocol (OCSP) service and
explains how the OCSP service verifies the current status of the certificates issued by the Certificate
Manager. The chapter also explains how to configure the Online Certificate Status Managers to
publish CRLs.

6.1. About OCSP Services

The Certificate System CA supports the Online Certificate Status Protocol (OCSP) as defined in
PKIX standard RFC 2560 (see http://www.ietf.org/rfc/rfc2560.txt). The OCSP protocol enables OCSP-
compliant applications to determine the state of a certificate, including the revocation status, without
having to directly check a CRL published by a CA to the validation authority. The validation authority,
which is also called an OCSP responder, checks for the application.
1. A CA is set up to issue certificates that include the Authority Information Access extension, which
identifies an OCSP responder that can be queried for the status of the certificate.
2. The CA periodically publishes CRLs to an OCSP responder.
3. The OCSP responder maintains the CRL it receives from the CA.
4. An OCSP-compliant client sends requests containing all the information required to identify the
certificate to the OCSP responder for verification. The applications determine the location of the
OCSP responder from the value of the Authority Information Access extension in the certificate
being validated.
5. The OCSP responder determines if the request contains all the information required to process
it. If it does not or if it is not enabled for the requested service, a rejection notice is sent. If it does
have enough information, it processes the request and sends back a report stating the status of
the certificate.

6.1.1. OCSP Response Signing

Every response that the client receives, including a rejection notification, is digitally signed by the
responder; the client is expected to verify the signature to ensure that the response came from
the responder to which it submitted the request. The key the responder uses to sign the message
depends on how the OCSP responder is deployed in a PKI setup. RFC 2560 recommends that the key
used to sign the response belong to one of the following:
• The CA that issued the certificate that's status is being checked.
• A responder with a public key trusted by the client. Such a responder is called a trusted responder.
• A responder that holds a specially marked certificate issued to it directly by the CA that revokes the
certificates and publishes the CRL. Possession of this certificate by a responder indicates that the
CA has authorized the responder to issue OCSP responses for certificates revoked by the CA. Such
a responder is called a CA-designated responder or a CA-authorized responder.
The end-entities page of a Certificate Manager includes a form for manually requesting a certificate for
the OCSP responder. The default enrollment form includes all the attributes that identify the certificate
157