{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Nexus OCSP Responder","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65345982"}}]},{"text":" can work as a client to remote OCSP responders and send requests for validation of certificates. This article describes how to configure the different methods the client can use to find the URL(s) of the remote OCSP responders. This is done in the \"Back end client\" section of the Nexus OCSP Responder configuration file. Specify the methods in the order you want them to be used.","type":"text"}]},{"type":"paragraph","content":[{"text":"The back end client configuration is optional.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify methods for the client to find URL","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.urlcheck.=[servicelocator|table|fromcert]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"9db9cc65-aa6a-444b-9571-16c6df56ffba"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the method sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"servicelocator | table | fromcert","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"servicelocator","type":"text","marks":[{"type":"code"}]},{"text":" method uses the ","type":"text"},{"text":"serviceLocator","type":"text","marks":[{"type":"code"}]},{"text":" request extension to get the URL of the authoritative responder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"table","type":"text","marks":[{"type":"code"}]},{"text":" method uses a table with two columns:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the rule to find a certain CA","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the URL of the corresponding remote OCSP responder.","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information, see section \"Lookup table\" below.","type":"text"}]}]}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"fromcert","type":"text","marks":[{"type":"code"}]},{"text":" method searches the certificate in the certificate cache (and in case of no hit and if lookup is specified, in a directory).","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The authorityInformationAccess (AIA) certificate extension is used to find the URL. Note that if you use Windows domains, do not include a trailing slash in the AIA attribute.","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"servicelocator","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Lookup table","type":"text"}]},{"type":"paragraph","content":[{"text":"This section describes the ","type":"text"},{"text":"table","type":"text","marks":[{"type":"code"}]},{"text":" method. Enumerate the rows in the table and identify all the specifications for a certain row with the sequence number for this row.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.urlcheck..table..issuermatch=\nocsp.client.urlcheck..table..url=","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Systems or applications that rely on OCSP responses, must verify each response according to specified criteria. This is described in section 4.2.2.2 of ","type":"text"},{"text":"RFC 6960 X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP","type":"text","marks":[{"type":"em"}]},{"text":", see ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://tools.ietf.org/html/rfc6960"}},{"text":" . ","type":"text"}]},{"type":"paragraph","content":[{"text":"Optionally, to comply with this section, these criteria can include that the signature certificate in the lookup response only need to match a specified name. This is useful if, for some reason, the response is not signed with a certificate related to the issuer of the queried certificate. This is only applicable if .","type":"text"},{"text":"..client.response.signature.check","type":"text","marks":[{"type":"code"}]},{"text":" is true. If you want to include this, add the following:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.urlcheck..table..respondername=","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"23ab3577-3311-4607-8c27-f6549a34e3bc"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the method sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the row sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the attributes to use for a match. Wildcards are allowed.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the URL to use if this rule matches.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the name of a trusted responder. Wildcards are allowed.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Back end client and TLS","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If TLS is used and the remote OCSP responder requires client authentication, specify a key for this:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.authentication.key.certificate=\nocsp.client.authentication.key.pin=","type":"text"}]},{"type":"paragraph","content":[{"text":"To encrypt the pin, see ","type":"text"},{"text":"Encryption of sensitive configuration parameters","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65346999#ConfigureNexusOCSPResponder-EncryptParameters"}}]},{"text":".","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"965b3c36-be43-4dfa-8794-dc783aedde2d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the certificate pattern to specify the key pair. For a description of the syntax, see heading “LDAP certificate patterns” in ","type":"text"},{"text":"Introduction to LDAP","type":"text","marks":[{"type":"link","attrs":{"href":"http://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349545/Introduction+to+LDAP"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the PIN for the key pair.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify OCSP client request","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify the OCSP client request as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.request.usecache=[true|false]\nocsp.client.request.http.method=[get|post]\nocsp.client.request.http.timeout=\nocsp.client.request.nonce=[true|false]\nocsp.client.request.nonce.size=\nocsp.client.request.signature.key.certificate=\nocsp.client.request.signature.key.pin=\nocsp.client.request.signature.othercerts=[none|byname|bykey]\nocsp.client.request.signature.chain=[none|cert|chain|allchains]\nocsp.client.request.signature.chain.includeroot=[true|false]\nocsp.client.request.freshnessproofs.add=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"a6e0f909-d58b-4b31-9466-2cd3df2699c7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...usecache","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to check, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to check the response cache first of all.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"get | post","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"get","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"post","type":"text","marks":[{"type":"code"}]},{"text":" to specify the HTTP method to be used when the OCSP client requests a remote responder.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"post","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with a time period expression (short form), specified according to ","type":"text"},{"text":"ISO 8601 Representation of dates and times","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.iso.org/iso-8601-date-and-time-format.html"}}]},{"text":". This is the maximum amount of time the client will wait for response.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example 1: P1Y2M3DT4H5M6S stands for 1 year, 2 months, 3 days, 4 hours, 5 minutes and 6 seconds.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example 2: P1D stands for 1 day.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Example 3: PT1H stands for 1 hour.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Note the extra separator ‘T’ before time units shorter than one day.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: PT30S","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...nonce","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to add, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to add \"nonce\" to the request. \"Nonce\" is random data, generated by the client and used to guarantee the freshness of a response and protect against replay attacks.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the size in bytes of the nonce.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"16","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the certificate pattern to specify the key pair. For a description of the syntax, see Section 6.2.3, “ Certificate Pattern ”.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the PIN for the key pair.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none | byname | bykey","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" will be ignored if the parameter ","type":"text"},{"text":"...chain","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":"\".","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that the request shall include only the signature certificate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":" to let Nexus OCSP Responder search the certificate cache for other certificates with the same public key as the signature certificate, but only include those in the request, which also have the same subject distinguished name.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":" to let Nexus OCSP Responder search the certificate cache for other certificates with the same public key as the signature certificate and include them in the request.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none | cert | chain | allchains","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that no signature certificate(s) shall be appended to the request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"cert","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that the signature certificate shall be appended to the request. If parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", all applicable certificates shall be appended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"chain","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that one chain of certificates, chaining to the trust store, shall be appended to the request. If parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", one chain for every applicable certificate shall be appended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"allchains","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that all possible certificate chains shall be appended to the request. If parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", all valid chains for all applicable certificates shall be appended.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"chain","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...includeroot","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter ","type":"text"},{"text":"...signature.chain.includeroot","type":"text","marks":[{"type":"code"}]},{"text":" is relevant only when parameter ","type":"text"},{"text":"...signature.chain","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"chain","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"allchains","type":"text","marks":[{"type":"code"}]},{"text":"\". Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to include, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to include the root certificate in the chains.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...freshnessproofs.add","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to query, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to query the local OCSP response cache for the status of the certificates in the signature chain and to add them to a freshness proof extension in the request, if possible.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify OCSP client response","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify the OCSP client response as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ocsp.client.response.allowunknown=[true|false]\nocsp.client.response.nonce.check=[true|false]\nocsp.client.response.signature.check=[true|false]\nocsp.client.response.signature.allowauthority=[true|false]\nocsp.client.response.chain.validate=[true|false]\nocsp.client.response.notolderthan=\nocsp.client.response.freshnessproof.handle=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"916348e7-3c9f-431f-a19e-34353f3b4938"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...allowunknown","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to accept, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to accept an OCSP response with status \"","type":"text"},{"text":"unknown","type":"text","marks":[{"type":"code"}]},{"text":"\". If this is enabled and the status would be unknown, a \"","type":"text"},{"text":"tryLater","type":"text","marks":[{"type":"code"}]},{"text":"\" response will be created and returned instead of the received response.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...nonce.check","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to check, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to check that if a nonce was included in the request, an identical nonce can be found in the response.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...signature.check","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to check, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to check the signature certificate. If this is enabled and the signature could not be verified, a \"","type":"text"},{"text":"tryLater","type":"text","marks":[{"type":"code"}]},{"text":"\" response will be created and returned instead of the received response. Disabling this can be a convenient way to always forward requests and their responses if the queried responders are trusted.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"..signature.allowauthority","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to accept an OCSP responder if the response signer was issued by an authority that is found in the certificate chain of the certificate for which status is requested, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" if not. This is only applicable if ","type":"text"},{"text":"...signature.check","type":"text","marks":[{"type":"code"}]},{"text":" is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...chain.validate","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to make a full validation of the whole chain of signature certificates. Enter ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" to make no validation. This is only applicable if ","type":"text"},{"text":"...signature.check","type":"text","marks":[{"type":"code"}]},{"text":" is ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with a time period expression (short form), specified according to ","type":"text"},{"text":"ISO 8601 Representation of dates and times","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.iso.org/iso-8601-date-and-time-format.html"}}]},{"text":" (see also information in the Constants and Values table under heading \"Specify OCSP Client request)\". If the difference between the current time and the ","type":"text"},{"text":"producedAt","type":"text","marks":[{"type":"code"}]},{"text":" value exceeds this setting, the response will not be used.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"No checking","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...freshnessproof.handle","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to extract, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to extract the freshness proof extension from the OCSP response if present and add the contents to the OCSP response cache.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Example of back end client section","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example of back end client section in the configuration file","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"ocsp.client.urlcheck.1=servicelocator\nocsp.client.urlcheck.2=table\nocsp.client.urlcheck.2.table.1.issuermatch=*\nocsp.client.urlcheck.2.table.1.url=http://ocsphost:90/basic\nocsp.client.request.usecache=true\nocsp.client.response.allowunknown=true","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Related information","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate lookup section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65348707"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Nexus OCSP Responder","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65346999"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RFC 6960 X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.rfc-editor.org/info/rfc6960"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ISO 8601 Representation of dates and times","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.iso.org/iso-8601-date-and-time-format.html"}}]}]}]}]}],"version":1}

Browser not supported