Versions Compared

Old Version 2

changes.mady.by.user Ann Base (Deactivated)

Saved on

compared with

New Version 3

changes.mady.by.user Ann Base (Deactivated)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This article and its sub-articles describe how to configure Nexus OCSP Responder. When running the Nexus OCSP Responder, the application will read files (for example, configuration and truststore) from <configuration root>. 

Prerequisites

Expand
titlePrerequisites

Installed Nexus OCSP Responder.

Step-by-step instruction

Expand
titleOpen the configuration file
  1. Open the configuration file for editing:

    1. On Windows, the path to the <configuration root> is chosen during installation and is defined in the string registry key named Arguments in the following Windows registry path:
      HKEY_LOCAL_MACHINE\SOFTWARE\Nexus\Service Parameters\OCSP

    2. On Linux, the path to the <configuration root> is defined in <install root>/bin/nexus-ocsp.conf by the following parameter:
      SERVICEARGUMENTS='-p <configuration root>
  2. You can manually change the path after the installation by redefining the path parameter to point to a new configuration root directory.


Expand
titleDo the mandatory settings

In the configuration file, each main configurable entity has its own section. The corresponding parameter names are built up with prefixes associated with the entity.

  1. Do the mandatory settings in the OCSP configuration file:

    Configurable EntityDescriptionPrefix
    Trust store

    The trust store is a file containing certificates for all trusted CAs.

    		ocsp.trust
    Certificate cache

    The certificate cache is a cache directory where "non-trusted" certificates are stored.

    		ocsp.certs
    Validation

    A certificate can be validated by checking for revocation data locally in a CRL or CIL cache.

    		ocsp.validation
    OCSP responder

    OCSP responders are preconfigured with different semantics. First make your choice between the preconfigurations, then specify the details for each responder.

    		responder
    Key management

    Keys are specified together with the configuration that uses them. The keys may be located in software tokens and in 3rd party devices.

    		key
    System management

    The agent is responsible for the communication with an existing system monitor (when used) and for logging.

    		agent



Expand
titleDo optional settings
  1. Do the other settings in the OCSP configuration file (optional).
Configurable EntityDescriptionPrefix

Certificate lookup (optional)

If a required certificate cannot be found in the cache, it may be searched in specified directories.

ocsp.certs
Back end client (optional)

Certificates can be validated by use of external OCSP responders. The OCSP client that should send the requests, will use several methods to find the responder URLs.

ocsp.client
OCSP response cache (optional)

The response cache is a cache where responses from external OCSP responders can be stored.

ocsp.cache


Configuration

See these articles for configuration of Nexus OCSP Responder:

Child pages (Children Display)

Descriptions and workflow

The articles that are gathered here: Nexus OCSP Responder descriptions and workflow include descriptions for various concepts used within Nexus OCSP Responder and also some useful workflows.See Nexus OCSP Responder descriptions and workflow.

General information

Expand
titleSpecify file paths

Full path

You can specify a full path to a file or a directory, such as ocsp.trust.store=C:\Program Files\Nexus\OCSP Responder\certs\trust.store.

Relative path

Alternatively, specify a relative path (default): ocsp.trust.store=certs/trust.store ("/" makes the specification architecturally independent)

On both Windows and Linux environments, the relative path will start from the <configuration root> directory.


Expand
titleCase sensitivity


EntityCase sensitive
Configuration parameter namesNo
File namesYes (when appearing as values, that is, on the right hand side of an "=")
LDAP searchbase and filtersYes (when appearing as values, that is, on the right hand side of an "=")
Distinguished name patterns used for certificate matchingYes (when appearing as values, that is, on the right hand side of an "=")
URLsYes (when appearing as values, that is, on the right hand side of an "=")
Constants and typesNo



Expand
titleAfter updates

When you have done configuration updates, restart Nexus OCSP Responder.


Anchor
EncryptParameters
EncryptParameters

Expand
titleEncryption of sensitive configuration parameters


Excerpt

To scramble any configuration parameter in the configuration file, add the keyword encrypted to the parameter definition in the configuration. The next time the application starts, it scans the configuration file for unscrambled values and scrambles the value. The updated configuration file is saved to disk.

For example: *.pin = 1234 is considered to be sensitive and should therefore be scrambled.

  1. To scramble the parameter, replace the parameter with *.pin.encrypted = 1234.
  2. The server will find the unscrambled value and scramble it.
  3. In the resulting configuration file the parameter is rewritten to *.pin.encrypted = encrypted:MCa12== for example.



Related information