Installed Nexus OCSP Responder.

1. Open the configuration file ocsp.conf for editing:

   1. On Windows, the path to the <configuration root> is chosen during installation and is defined in the string registry key named Arguments in the following Windows registry path:
      HKEY_LOCAL_MACHINE\SOFTWARE\Nexus\Service Parameters\OCSP

   2. On Linux, the path to the <configuration root> is defined in <install root>/bin/nexus-ocsp.conf by the following parameter:
      SERVICEARGUMENTS='-p <configuration root>
2. You can manually change the path after the installation by redefining the path parameter to point to a new configuration root directory.

In the configuration file, each main configurable entity has its own section. The corresponding parameter names are built up with prefixes associated with the entity.

1. Do the mandatory settings in the OCSP configuration file:

   Configurable Entity	Description	Prefix
   Trust store	The trust store is a file containing certificates for all trusted CAs.	ocsp.trust
   Certificate cache	The certificate cache is a cache directory where "non-trusted" certificates are stored.	ocsp.certs
   Validation	A certificate can be validated by checking for revocation data locally in a CRL or CIL cache.	ocsp.validation
   OCSP responder	OCSP responders are preconfigured with different semantics. First make your choice between the preconfigurations, then specify the details for each responder.	responder
   Key management	Keys are specified together with the configuration that uses them. The keys may be located in software tokens and in 3rd party devices.	key
   System management	The agent is responsible for the communication with an existing system monitor (when used) and for logging.	agent

1. Do the other settings in the OCSP configuration file (optional).

Full path

You can specify a full path to a file or a directory, such as ocsp.trust.store=C:\Program Files\Nexus\OCSP Responder\certs\trust.store.

Relative path

Alternatively, specify a relative path (default): ocsp.trust.store=certs/trust.store ("/" makes the specification OS-independent)

On both Windows and Linux environments, the relative path will start from the <configuration root> directory.

When you have done configuration updates, restart Nexus OCSP Responder.

To scramble any configuration parameter in the configuration file, add the keyword encrypted to the parameter definition in the configuration. The next time the application starts, it scans the configuration file for unscrambled values and scrambles the value. The updated configuration file is saved to disk.

For example: *.pin = 1234 is considered to be sensitive and should therefore be scrambled.

1. To scramble the parameter, replace the parameter with *.pin.encrypted = 1234.
2. The server will find the unscrambled value and scramble it.
3. In the resulting configuration file the parameter is rewritten to *.pin.encrypted = encrypted:MCa12== for example.