Revocation Check for Peer Certificates

FastIron devices in Common Criteria mode support OCSP for checking the revocation status of a certificate received from a peer. The revocation status is checked for both the intermediate and the peer certificate. The following actions are taken in revocation checks:

  • The OCSP signing bit should be set for the OCSP responder.
  • If the OCSP responder responds that the certificate status is good, the TLS session comes up.
  • If the OCSP responder responds that the certificate status is revoked, the TLS session does not come up.
  • If the OCSP server is not reachable and the response is not received, then the TLS session does not come up between the peers.

The OCSP URL is picked up from the certificates received from the peer. The default configuration is "revocation-check none" and the status of the revoked certificate is not checked. When the command revocation-check ocsp is configured as part of the trustpoint configuration, OCSP protocol is used to check the status of certificates received from the peer. The command "ocsp-url http://15.1.1.1:2560" is used to identify the URL for the OCSP responder.

By default, an HTTP "get" command is used to reach the OCSP responder. This method can be changed to an HTTP post using the command "ocsp http post" as shown in the following example. 

device# configure terminal
device(config)# pki trustpoint abcd
device(config-pki-trustpoint-abcd)# ocsp http post    <-- Optional command. Applies only to Linux.
device(config-pki-trustpoint-abcd)# revocation-check ocsp
device(config-pki-trustpoint-abcd)# ocsp-url http://15.1.1.1:2560
device(config-pki-trustpoint-abcd)# rsakeypair key-label rsakey
device(config-pki-trustpoint-abcd)# fingerprint 3C:EA:EC:E6:F1:DD:3B:86:65:DE:58:F4:A2:75:D8:63:6D:23:68:40
device(config-pki-trustpoint-abcd)# exit
device(config)#

The certificates are also checked to ensure the Syslog or RADIUS server presents a certificate that includes the "Server Authentication" Extended Key Usage (EKU). The OCSP Responder must sign its responses with an EKU of OCSP Signing.

Parent topic: Configuring PKI