Versions Compared

Old Version 2

changes.mady.by.user Ann Base

Saved on

compared with

New Version Current

changes.mady.by.user Ylva Andersson

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Minor

You can test the configuration and setup of Nexus OCSP Responder by using the bundled OCSP client. It is named ocsp_client.bat on Windows and ocsp_client on the available Linux distributions. The OCSP client is located in the /bin directory relative to the installation root.

The basic usage of the bundled OCSP client is as follows:

Code Block
ocsp_client -verbose -url <url> -certstore <trust-store> -nonce
-servicelocator <url> -authcert <certificate> -authpin <pin>
-pkcs11lib <lib> -provider <provider> -signalg <algorithm>
-signcert <certificate> -signpin <pin> -[no]chain <serial-nr> ...

Table...

Options and Arguments

Description

-authcert <certificate>

The certificate to use for TLS client authentication. Replace <certificate> with either the filename of the PKCS12 encoded token or unique part of subject DN of certificates in PKCS11 key store. See also -pkcs11lib.

-authpin <pin>

Replace <pin> with the pin to use for accessing the key associated with the certificate.

-certstore <trust-store>

Replace <trust-store> with the name of a file containing root CAs and subordinate CAs.

-signcert <certificate>

The certificate to use for signing the OCSP request. Replace <certificate> with either the filename of PKCS12 encoded token or unique part of subject DN of certificates in PKCS11 key store. See also -pkcs11lib.

-signpin <pin>

Replace <pin> with the pin to use for accessing the key associated with the certificate.

-chain

Use this option to add a certificate chain to the signed OCSP request. Only the signature certificate will be used in the signed OCSP request by default.

-nochain

Use this option to not add the signature certificate or chain to the signed OCSP request.

-nonce

Use this option to add a random nonce to the request.

-pkcs11lib <lib>

Replace <lib> with the name of a PKCS11 library. Must be specified to use authentication or signature certificate in a PKCS11 key store.

-provider <provider>

Replace <provider> with the provider name or class name of a JCE provider to perform the signature.

-servicelocator <url>

Replace <url> with the location of an alternate OCSP responder that the responder we query can redirect the request to.

-signalg <algorithm>

Replace <algorithm> with the name of the signature algorithm to use.

-url <url>

Replace <url> with the location of the OCSP responder to send a request to.

-verbose

Use this option to print out debug data and more information about the response.

<serial-nr>

Either a file containing the certificate one wants to query the status of or a certificate serial number and issuer name specified as: <number>:<issuer DN or part of>. The number can be specified either as decimal or as hexadecimal, prefixed with 0x.

Examples

...

Example 1: single, unsigned, non-nonced request

Code Block
ocsp_client -verbose -url http://ocsphost:81/ -certstore trust.store example1.crt

...

Example 2: single, unsigned, non-nonced request

Code Block
ocsp_client -verbose -url http://ocsphost:81/ -certstore trust.store "0x42f3d19e9fe13f98b8c7b98f10bf6c2d:cn=Issuing CA,c=SE"

...

...
Example 3: unsigned nonced multirequest over client-authenticated TLS
 Code Block
ocsp_client -verbose -url https://ocsphost:81/ -certstore trust.store -nonce -authcert "Ocsp Test Auth" -authpin 1234 -pkcs11lib pkcs11_library.dll example1.crt example2.crt
...
Example 4: signed, non-nonced request about a root certificate
 Code Block
ocsp_client -verbose -url http://ocsphost:81/ -certstore trust.store -signcert "Ocsp Test Sign" -signpin 1234 -pkcs11lib pkcs11_library.dll root-cert.crt
...
Related information
...