Using The Online Certificate Status Protocol Responder; Setting Up The Ocsp Responder - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Chapter 7.
Using the Online Certificate Status
Protocol Responder
This chapter provides an overview of an Online Certificate Status Protocol (OCSP) service and
explains how the OCSP service verifies the current status of the certificates issued by the Certificate
Manager. The chapter also explains how to configure the Online Certificate Status Managers to
publish CRLs.

7.1. Setting up the OCSP Responder

If a CA within the security domain is selected when the Online Certificate Status Manager is
configured, there is no extra step required to configure the OCSP service. The CA's CRL publishing
is set up automatically, and its signing certificate is automatically added and trusted in the Online
Certificate Status Manager's certificate database. However, if a non-security domain CA is selected,
then the OCSP service must be manually configured after the Online Certificate Status Manager is
configured.
NOTE
Not every CA within the security domain to which the OCSP Manager belongs is
automatically trusted by the OCSP Manager when it is configured. Every CA in the
certificate chain of the CA configured in the CA panel is trusted automatically by the
OCSP Manager. Other CAs within the security domain but not in the certificate chain must
be trusted manually.
To set up the Online Certificate Status Manager for a Certificate Manager outside the security domain,
do the following:
1. Configure the CRLs for every CA that will publish to an OCSP responder. See
Revoking Certificates and Issuing CRLs
2. Enable publishing, set up a publisher, and set publishing rules in every CA that the OCSP service
Chapter 8, Publishing Certificates and CRLs
will handle. See
the Certificate Managers publish to an LDAP directory and the Online Certificated Status Manager
is set up to read from that directory.
3. The certificate profiles must be configured to include the Authority Information Access extension,
pointing to the location at which the Certificate Manager listens for OCSP service requests. See
Section 7.3, "Enabling the Certificate Manager's Internal OCSP Service"
4. Configure the OCSP Responder.
• Configure the Revocation Info stores. See
• Identify every publishing Certificate Manager to the OCSP responder. See
"Identifying the CA to the OCSP Responder"
• If necessary, configure the trust settings for the CA which signed the OCSP signing certificate.
Section 16.6, "Changing the Trust Settings of a CA Certificate"
See
5. Restart both subsystems after configuring them.
for details.
for details. This is not necessary if
Section 7.2.2, "Configure the Revocation Info
for details.
Chapter 6,
for more information.
Stores".
Section 7.2,
for details.
187