This article describes how to configure Nexus OCSP Responder to validate a certificate. This is done in the "Validation" section of the Nexus OCSP Responder configuration file. Certificates can be validated by checking for revocation data locally in a CRL (Certificate Revocation List) or (if enabled) in a CIL (Certificate Issuance List) cache or by forwarding the request to a remote OCSP responder.

It is recommended to configure no more than one validator per type (CRL or CIL). A validator can be configured with multiple providers of different types (pull or push).

Each validator works against a cache, where all the CRLs/CILs that are obtained by the configured providers are placed. The cache is stored in a directory on disk where every new CRL/CIL is saved. The default cache directories are crls for the CRL validator and cils for the CIL validator. At restart, the caches are initialized from these directories. You can manually copy certain CRLs/CILs to the directories before you start Nexus OCSP Responder the first time.

...

A validator can be of type: CRL or CIL.

In the OCSP configuration file, specify as follows:

ocsp.validation.<v#>.type=[crl|cil]

Description of constants and values:

...

crl | cil


...

Enter crl to indicate that the validator shall work with the CRL cache.

Enter cil to indicate that the validator shall work with the CIL cache.

...

For each validator:

• Specify at least one provider to keep the CRL cache constantly up-to-date. This can be done by pull or push methods:
  
  • type=pull - Periodically polling a directory for new CRL versions. Note that pull is not available for CILs.
  • type=push - Waiting for incoming CRLs/CILs, pushed from a CA, for example, Nexus Certificate Manager.

For each provider, specify as follows in the OCSP configuration file:

ocsp.validation.<v#>.provider.<p#>.type=[pull|push]

Description of constants and values:

...

pull | push

...

• Enter pull to indicate that the provider shall fetch CRL information. See Configure CRL provider type Pull for additional specifications.
• Enter push to indicate that the provider shall listen for CRL/CIL information. See Configure CRL/CIL provider type Push for additional specifications.

CRL providers with type=pull are not available for CILs.

...

The CA that provides the directory service can supply one or more alternative site(s). If so, you can specify a list of URLs.

For each CRL provider with type=pull, configure how to find the directory. This can be done by the use of either the LDAP/LDAPS protocol or the HTTP/HTTPS protocol. Identify the specifications for each site by a URL sequence number. In the OCSP configuration file, specify as follows:

ocsp.validation.<v#>.provider.<p#>.url.<u#>=
	[[ldap|ldaps]://<host>[:<port>]/<dn>?
		[certificaterevocationlist|deltacertificaterevocationlist]] |
		[[http|https]://<host>[:<port>]/<path>]

If login is required for a certain provider you must specify the parameters ...username and ...password.

ocsp.validation.<v#>.provider.<p#>.url.<u#>.username=<user name>
ocsp.validation.<v#>.provider.<p#>.url.<u#>.password=<password>
ocsp.validation.<v#>.provider.<p#>.period=<time expr>
ocsp.validation.<v#>.provider.<p#>.ignoreIDP=[true|false]

Description of constants and values:

...

ldap | ldaps

...

• Enter ldap to indicate that the LDAP protocol shall be used (TLS is not needed).
• Enter ldaps to indicate that the LDAPS protocol shall be used (TLS is needed).

...

<host>[:<port>]

...

<dn>

...

Replace <dn> with the distinguished name of the directory entry.

...

certificaterevocationlist |
deltacertificaterevocationlist

...

• Enter certificaterevocationlist if the URL provides full CRLs.
• Enter deltacertificaterevocationlist if the URL provides delta CRLs.

...

http | https

...

• Enter http to indicate that the HTTP protocol shall be used (TLS is not needed).
• Enter https to indicate that the HTTPS protocol shall be used (TLS is needed).

...

<host>[:<port>]/<path>

...

<user name>

...

Replace <user name> with the user name that is required for this directory.

...

<password>

...

<time expr>

...

Replace <time expr> with a time period expression (short form), specified according to ISO 8601 Representation of dates and times. (see section “Specify OCSP client request” in Back end client section). This value will set the periodicity of updates.

Default: PT1H

...

true | false

...

The CRL may contain an Issuing Distribution Point (IDP) extension. IDP marks a CRL as being incomplete, and thus reliable revocation queries cannot be answered from it. If you have out of band information that a CRL with an IDP is indeed complete, you may force Nexus OCSP Responder to accept this CRL.

• If an IDP extension exists and ignoreIDP is set to true, always accept the CRL.
• If an IDP extension exists and ignoreIDP is set to false, reject the CRL. In both cases a message will be written to the log file.

Default: false

Example:

ocsp.validation.1.type=crl
ocsp.validation.1.provider.1.type=pull
ocsp.validation.1.provider.1.url.1=
	ldap://directory/cn=Test CA2,
		o=Nexus OCSP Responder,
		c=se?certificaterevocationlist
ocsp.validation.1.provider.1.url.1.username=cn=admin,c=se
ocsp.validation.1.provider.1.url.1.password=****
ocsp.validation.1.provider.1.url.2=http://backuphost.com/testca2.crl
ocsp.validation.1.provider.1.period=P1D

...

...

ocsp.validation.<v#>.provider.<p#>.listen.url=<URL>
ocsp.validation.<v#>.provider.<p#>.ignoreIDP=[true|false]
ocsp.validation.<v#>.provider.<p#>.ssl.clientauth=[true|false]
ocsp.validation.<v#>.provider.<p#>.ssl.certificate=<certificate pattern>
ocsp.validation.<v#>.provider.<p#>.ssl.pin=<PIN>
ocsp.validation.<v#>.provider.<p#>.ssl.cipher=<cipher suites>
ocsp.validation.<v#>.provider.<p#>.ssl.protocol=<protocols>

Description of constants and values:

...

Replace <URL> with the URL the provider shall listen to (HTTP or HTTPS only).

...

<certificate pattern>

...

If HTTPS is used, a key and certificate needs to be specified. See Key management section.

...

true | false for parameter ..ignoreIDP

...

The CRL/CIL may contain an Issuing Distribution Point (IDP) extension. IDP marks a CRL/CIL as being incomplete, and thus reliable revocation queries cannot be answered from it. If you have out of band information that a CRL/CIL with an IDP is indeed complete, you may force Nexus OCSP to accept this CRL/CIL.

• If an IDP extension exists and ignoreIDP is set to true, always accept the CRL/CIL.
• If an IDP extension exists and ignoreIDP is set to false, reject the CRL/CIL. In both cases a message will be written to the log file.

Default: false

...

true | false for parameter ..ssl.clientauth

...

• If client TLS authentication is required, set this to true (HTTPS only).
• If client TLS authentication is not required, set this to false.

Default: false

...

A comma separated list of TLS cipher suites that should be enabled.

If HTTPS is enabled, then limit the number of enabled cipher suites to a subset of the default. If no ciphers are specified all the following default will be enabled:
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256

...

A comma separated list of TLS protocols that should be enabled.

If HTTPS is enabled, then limit the number of enabled security protocols to a subset of the default. If no protocols are specified the following default will be enabled:
TLSv1.3
TLSv1.2

Example:

ocsp.validation.1.type=cil
ocsp.validation.1.provider.3.type=push
ocsp.validation.1.provider.3.listen.url=http://ocsphost.com:87/

Related information

• Configure Nexus OCSP Responder
• Key management section
• Introduction to LDAP
• RFC 2255 The LDAP URL Format
• ISO 8601 Representation of dates and times