{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This article includes updates for Nexus OCSP Responder 6.3.0.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"This article describes how to specify the OCSP responders that shall handle the incoming OCSP requests (these OCSP responders are referred to as 'the logical OCSP responders', for more information, see ","type":"text"},{"text":"Nexus OCSP Responder architecture overview","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349092"}}]},{"text":"). The specification is done in the \"OCSP responder\" section of the ","type":"text"},{"text":"Nexus OCSP Responder","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65345982"}}]},{"text":" configuration file. There are predefined OCSP responders with different semantics. Use the ","type":"text"},{"text":"type","type":"text","marks":[{"type":"code"}]},{"text":" parameter to specify which one to use. The workflows for different types of OCSP responders are described in ","type":"text"},{"text":"Workflow for Nexus OCSP Responders","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349103"}}]},{"text":".","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A responder may also forward the request to a remote OCSP responder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Each responder can support multiple CAs.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure a signer for each CA that the responder should support.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the responders, configure each CA that shall be supported.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"The responder replies with status 'Unknown' to OCSP requests for certificates issued by CAs that the responder is not responsible for. When receiving requests related to CAs that are not supported, the first configured signer is used to sign the response. This means that a default \"dummy\" signing certificate can be configured as the first supported issuer/signer for responding to irrelevant or malicious requests.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify the OCSP responders","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"It is mandatory to specify at least one responder and set the following parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...type","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...url","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...workers","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...signer.x.issuerdn","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...signer.x.dn","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"...signer.x.pin","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Authentication, authorization and billing are disabled by default.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"For each OCSP responder, specify as follows in the OCSP configuration file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..type=[basic|cached|identrus-basic|identrus-cached|non-issued-basic|non-issued-cached|fallback]\nresponder..url=[http|https]://[:][/]\n\n; ssl node\nresponder..ssl.clientauth=[true|false]\nresponder..ssl.certificate=\nresponder..ssl.pin=\nresponder..ssl.cipher=\nresponder..ssl.protocol=\n\nresponder..workers=<# of workers>\nresponder..connections=<# of connections>\nresponder..socketreadtimeout=\nresponder..forwarding.enabled=[true|false]\n\n; signer node\nresponder..signer..issuerdn=\nresponder..signer..certificate=\nresponder..signer..signingalgorithm=\nresponder..signer..pin=\nresponder..signer..setnextupdate=[true|false]\n\n; fallback node\nresponder..fallback.certificate=\nresponder..fallback.pin=\nresponder..fallback.truststore=\nresponder..fallback.url=\nresponder..fallback.checkonhold=[true|false]\n\nresponder..archivecutoff=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]},{"type":"table","attrs":{"layout":"align-start","width":1800.0,"localId":"51f9c13a-57eb-43d6-9f6f-d3aeceffa6ef"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"Configuration","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"Type description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"type=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Defines the type of responder, the following responder types are available :","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"basic","type":"text","marks":[{"type":"code"}]},{"text":" to include capabilities for authentication, authorization and billing. These capabilities are included in all of the following.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"cached","type":"text","marks":[{"type":"code"}]},{"text":" to add capabilities to those of basic for checking of the response cache.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"identrus-basic","type":"text","marks":[{"type":"code"}]},{"text":" to add capabilities to those of basic for no ","type":"text"},{"text":"nextUpdate","type":"text","marks":[{"type":"code"}]},{"text":" in OCSP responses.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"identruscached","type":"text","marks":[{"type":"code"}]},{"text":" to add capabilities to those of basic for checking of the response cache, freshness proof and no ","type":"text"},{"text":"nextUpdate","type":"text","marks":[{"type":"code"}]},{"text":" in OCSP responses.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"non-issued-basic","type":"text","marks":[{"type":"code"}]},{"text":" to include capabilities for authentication, authorization (extended), validation of non-issued certificates (see ","type":"text"},{"text":"Certificate Issuance List - CIL","type":"text","marks":[{"type":"link","attrs":{"href":"http://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65351417/Certificate+Issuance+List+-+CIL"}}]},{"text":").","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"non-issued-cached","type":"text","marks":[{"type":"code"}]},{"text":" to add capabilities to those of non-issued-basic for checking of the response cache.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Enter ","type":"text"},{"text":"fallback","type":"text","marks":[{"type":"code"}]},{"text":" to activate CF-fallback functionality for requesting the real-time certificate status from CF.","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph","content":[{"text":"The responder Type, :","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" choose one (","type":"text"},{"text":"mandatory","type":"text","marks":[{"type":"strong"}]},{"text":"):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"basic ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"cached ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"identrus-basic","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"identruscached","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"non-issued-basic","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"non-issuedcached","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"fallback","type":"text","marks":[{"type":"code"}]}]}]}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.type = basic","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"url=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Listening address of the responder","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" should follow the format: ","type":"text"},{"type":"hardBreak"},{"text":"[http|https]://:/","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": listening host, Use ","type":"text"},{"text":"*","type":"text","marks":[{"type":"code"}]},{"text":" if the responder should listen on all interfaces.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":":","type":"text","marks":[{"type":"code"}]},{"text":" : specify the port","type":"text"},{"type":"hardBreak"},{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":":80","type":"text","marks":[{"type":"code"}]},{"text":" for HTTP ","type":"text"},{"text":":443","type":"text","marks":[{"type":"code"}]},{"text":" for HTTPS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"/","type":"text","marks":[{"type":"code"}]},{"text":": specify the path","type":"text"},{"type":"hardBreak"},{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": empty","type":"text"}]}]}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.url=http://*:8080/fallback","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"ssl.clientauth=[true|false]","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"ssl.certificate=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"ssl.pin=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"ssl.cipher=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"ssl.protocol=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"SSL configuration for the responder (https only).","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ssl.clientauth","type":"text","marks":[{"type":"code"}]},{"text":" : defines if client authentication is required","type":"text"},{"type":"hardBreak"},{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ssl.certificate","type":"text","marks":[{"type":"code"}]},{"text":": specifies the server certificate to use from the key store.","type":"text"},{"type":"hardBreak"},{"text":"See ","type":"text"},{"text":"Key management section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349760"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ssl.pin","type":"text","marks":[{"type":"code"}]},{"text":": specifies the pin used to access the specified server certificate and private key.","type":"text"},{"type":"hardBreak"},{"text":" See ","type":"text"},{"text":"Key management section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349760"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ssl.cipher","type":"text","marks":[{"type":"code"}]},{"text":": TLS cipher suites that should be enabled.","type":"text"},{"type":"hardBreak"},{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": all supported cipher suites of Java's SunJSSE (","type":"text"},{"text":"Java Secure Socket Extension (JSSE) Reference Guide for JDK 11","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.oracle.com/en/java/javase/11/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345"}}]},{"text":") ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ssl.protocol","type":"text","marks":[{"type":"code"}]},{"text":": TLS protocols that should be enabled","type":"text"},{"type":"hardBreak"},{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": all supported protocols of Java's SunJSSE (","type":"text"},{"text":"Java Secure Socket Extension (JSSE) Reference Guide for JDK 11","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.oracle.com/en/java/javase/11/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345"}}]},{"text":")","type":"text"}]},{"type":"paragraph"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": A comma separated list of TLS cipher suites that should be enabled.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": A comma separated list of TLS protocols that should be enabled.","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.ssl.clientauth=true","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.ssl.certificate=CN=nexus-tls-certificate","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.ssl.pin=1234","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.ssl.cipher=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.ssl.protocol=TLSv1.2,TLSv1.3","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"workers=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"The number of requests that can be handled simultaneously.","type":"text"}]},{"type":"paragraph","content":[{"text":"The optimal value depends on the number of processors, processing power and memory.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"10","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.workers=16","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"signer..issuerdn=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"signer..certificate=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"signer..signingalgorithm=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"signer..pin=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"signer..setnextupdate=[true|false]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Configuration for the responder’s signer.","type":"text"}]},{"type":"paragraph","content":[{"text":"Multiple signers can be defined per responder by simply incrementing the signer index: ","type":"text"},{"text":"#s","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information and examples see: key-management-section.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":": defines if ","type":"text"},{"text":"NextUpdate ","type":"text","marks":[{"type":"em"}]},{"text":"attribute should be included in the signer’s response","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.signer.1.issuerdn=cn=Root CA,c=SE","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.signer.1.certificate=cn=OCSP-signer*","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.signer.1.signingalgorithm=SHA256withRSA","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"responder.1.signer.1.pin=1234","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"expiryCheck.disable=true|false","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"expiryCheck.period=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"expiryCheck.warningBefore=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"expiryCheck.severeBefore=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Expiry Check is a service that sends reminder logs when a responder' signer certificate is about to expire.","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information on how to configure this service check out the OCSP expiry Check page.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.expiryCheck.disable=false","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"responder.1.expiryCheck.period=P24H","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"responder.1.expiryCheck.warningBefore=P30D","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"responder.1.expiryCheck.severeBefore=P5D","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"connections=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"The number of requests that can be handled simultaneously. The optimal value depends on the number of processors, processing power and memory.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": 2000","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.connections=10","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"socketreadtimeout=","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"socketreadtimeout","type":"text","marks":[{"type":"code"}]},{"text":" After a socket has been opened to the server, the server will wait for this amount of time until it will automatically close the socket if no request has been received.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"PT1M","type":"text","marks":[{"type":"code"}]},{"text":" (one minute)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" should follow iso-8601 duration format. ","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.socketreadtimeout=PT1M","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"forwarding.enabled=[true|false]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"This parameter defines if forwarding should be enabled.","type":"text"}]},{"type":"paragraph","content":[{"text":"Read more in \"Specify forwarding of requests\" below.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"responder.1.forwarding.enabled=false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"archivecutoff=[true|false]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"Defines if the ","type":"text"},{"text":"ArchiveCutoff","type":"text","marks":[{"type":"code"}]},{"text":" extension is included in the responder’s response.","type":"text"}]},{"type":"paragraph","content":[{"text":" This extension will utilize the value from the ","type":"text"},{"text":"ExpiredCertsInCrl","type":"text","marks":[{"type":"code"}]},{"text":" extension in the Certificate Revocation List (CRL) and will only be added if the corresponding extension is present. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"archivecutoff=true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[424.0]},"content":[{"type":"paragraph","content":[{"text":"fallback.certificate=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.pin=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.truststore=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.url=","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.checkonhold=[true|false]","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[542.0]},"content":[{"type":"paragraph","content":[{"text":"This configuration node is specific to the ","type":"text"},{"text":"fallback","type":"text","marks":[{"type":"code"}]},{"text":" responder type.","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information about this responder's configuration see: fallback responder page.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[296.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"fallback.certificate=CN=cf-fallback-officer-1","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.pin=1234","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.truststore=fallback-truststore/","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.url=https://pgwy:8444/pgwy/api/certificates","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"fallback.checkonhold=true","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify limitations on incoming requests","type":"text"}]},{"type":"paragraph","content":[{"text":"To read more regarding access control, see ","type":"text"},{"text":"Access control and billing","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65348755"}}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Specify limitations on the incoming requests to the OCSP responder as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..incoming.signature.required=[true|false]\nresponder..incoming.authorization=[none|bynamematch|byauthentication]","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you enter ","type":"text"},{"text":"bynamematch","type":"text","marks":[{"type":"code"}]},{"text":" you also have to specify a table of rules to find a match of the distinguished name as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..incoming.authorization.match.=","type":"text"}]},{"type":"paragraph","content":[{"text":"See also ","type":"text"},{"text":"Distinguished name matching","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65351192"}}]},{"text":" and ","type":"text"},{"text":"Access control and billing","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65348755"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In addition, you can also use a certificate pattern to filter allowed client requests, specify as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..incoming.filter.=","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"aab33628-3e82-4852-a551-3b5218be525b"},"marks":[{"type":"fragment","attrs":{"name":"Table 3","localId":"52088865-9999-4f71-a07f-d8f5e689dd51"}}],"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the responder sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...signature.required","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to require, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to require the request to be signed. If you intend to perform billing and SSL is not used, enter true.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none | bynamematch | byauthentication","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"This configures authorization of the client certificate. If the request is signed, that certificate will be verified during authorization. Otherwise the client certificate used in the TLS handshake will be verified.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that no authorization check shall be performed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"bynamematch","type":"text","marks":[{"type":"code"}]},{"text":" to indicate a search for a match in the specified table. This setting is effective only if either of the parameters ","type":"text"},{"text":"...ssl.clientauth","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"...signature.required","type":"text","marks":[{"type":"code"}]},{"text":" is set to true.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"byauthentication","type":"text","marks":[{"type":"code"}]},{"text":" to look for the certificate in the OCSP responders trust store.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the name sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the rule to match the distinguished name. Wildcards are allowed.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"A certificate pattern as described in ","type":"text"},{"text":"Introduction to LDAP","type":"text","marks":[{"type":"link","attrs":{"href":"http://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349545/Introduction+to+LDAP"}}]},{"text":". Filters authenticated certificates on certificate attributes (part of the authorization scheme). Default is not to filter, which allows any authenticated certificate to bypass the filter mechanism.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify responder and responses","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows: ","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..signature.enforceocspsign=[true|false]\nresponder..signature.othercerts=[none|byname|bykey]\nresponder..signature.chain=[none|cert|chain|allchains]\nresponder..signature.chain.includeroot=[true|false]\nresponder..responderid=[byname|bykey|byski]\nresponder.acceptPlusSignInRequests=[true|false]\nresponder.endSpaceInHttpStatusLine=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"5543cc9d-6df7-48db-8b17-432c74db712f"},"marks":[{"type":"fragment","attrs":{"name":"Table 4","localId":"1f82cb9e-2b4d-4c7f-af43-130aa2461921"}}],"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the responder sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...enforceocspsign","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to check, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to check that \"OCSP signing\" is set in the extension ","type":"text"},{"text":"ExtendedKeyUsage","type":"text","marks":[{"type":"code"}]},{"text":" of the signature certificate(s).","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"If this parameter is set to ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"ExtendedKeyUsage","type":"text","marks":[{"type":"code"}]},{"text":" does not contain \"OCSP signing\", Nexus OCSP Responder will write a message to the log file and stop executing.","type":"text"}]},{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none | byname | bykey","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that the response shall include only the signature certificate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":" to let Nexus OCSP Responder search the certificate cache for other certificates with the same public key as the signature certificate, but only include those in the response, which also have the same subject distinguished name.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":" to let Nexus OCSP Responder search the certificate cache for other certificates with the same public key as the signature certificate and include them in the response.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: none","type":"text"}]},{"type":"paragraph","content":[{"text":"The parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" will be ignored if the parameter ","type":"text"},{"text":"...chain","type":"text","marks":[{"type":"code"}]},{"text":" is set to ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none | cert | chain | allchains","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"none","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that no signature certificate(s) shall be appended to the response.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"cert","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that the signature certificate shall be appended to the response. If parameter","type":"text"},{"text":" ...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", all applicable certificates shall be appended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"chain","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that one chain of certificates, chaining to the trust store, shall be appended to the response. If parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", one chain for every applicable certificate shall be appended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"allchains","type":"text","marks":[{"type":"code"}]},{"text":" to indicate that all possible certificate chains shall be appended to the response. If parameter ","type":"text"},{"text":"...othercerts","type":"text","marks":[{"type":"code"}]},{"text":" is set to \"","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":"\" or \"","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":"\", all valid chains for all applicable certificates shall be appended.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"chain","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...includeroot","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to include, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to include the root certificate in the chains.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"This parameter is relevant only when ","type":"text"},{"text":"...signature.chain","type":"text","marks":[{"type":"code"}]},{"text":" is set to ","type":"text"},{"text":"chain ","type":"text","marks":[{"type":"code"}]},{"text":"or ","type":"text"},{"text":"allchains","type":"text","marks":[{"type":"code"}]},{"text":". ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"byname | bykey | byski","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...responderid","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]},{"text":" to identify the responder by its distinguished name in the response.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"bykey","type":"text","marks":[{"type":"code"}]},{"text":" to identify the responder by the hash value of its public key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"byski","type":"text","marks":[{"type":"code"}]},{"text":" to identify the responder by the value from the X.509 extension \"Subject Key Identifier\".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"byname","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...acceptPlusSignInRequests","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Set this parameter to ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to make OCSP accept plus signs in incoming requests.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...endSpaceInHttpStatusLine","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Use this parameter to align HTTP responses with RFC9112 by adding a space after the status code, even if there isn't a reason-phrase. If set to ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" then the status line will be in the following form: ","type":"text"},{"type":"hardBreak"},{"text":"statusline = HTTP-version SP status-code SP [ reason-phrase ]","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify billing information","type":"text"}]},{"type":"paragraph","content":[{"text":"Billing is described in ","type":"text"},{"text":"Access control and billing","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65348755"}}]},{"text":".","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..billing.enabled=[true|false]\nresponder..billing.perrequest=[true|false]\nresponder..billing.percert=[true|false]\nresponder..billing.countunknown=[true|false]\nresponder..billing.includestatus=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"4724c5be-d210-4571-9bc4-47505f6b6d00"},"marks":[{"type":"fragment","attrs":{"name":"Table 5","localId":"1c00a2a8-a880-4f05-858e-850808704b6f"}}],"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the responder sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter ","type":"text"},{"text":"...billing.enabled","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to enable, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to enable billing.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...billing.perrequest","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to count, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to count each request for revocation information the original client request will cause.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...billing.percert","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to count, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to count each requested certificate.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...billing.countunknown","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to include, or ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" to not include responses with the status \"unknown\" in logging for ","type":"text"},{"text":"percert","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]},{"text":" for parameter","type":"text"},{"type":"hardBreak"},{"text":"...billing.includestatus","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to include, or ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" to not include certificate status in logging for ","type":"text"},{"text":"percert","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify forwarding of requests","type":"text"}]},{"type":"paragraph","content":[{"text":"Forwarding of requests is carried out by the back end OCSP client, which by default will use the settings you made in ","type":"text"},{"text":"Back end client section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045649"}}]},{"text":", section\"Specify OCSP client request\". To override any of these settings, add a new specification here.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the same syntax as described for the back end client but replace ","type":"text"},{"text":"ocsp.client","type":"text","marks":[{"type":"code"}]},{"text":" with ","type":"text"},{"text":"responder..forwarding.client","type":"text","marks":[{"type":"code"}]},{"text":", where ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is the responder sequence number.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example:","type":"text"}]},{"type":"paragraph","content":[{"text":"In this example, forwarding is enabled for queries related to certificates issued by the My CA authority.","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder.2.type=basic\nresponder.2.forwarding.enabled=true\nresponder.2.forwarding.client.response.allowunknown = true\nresponder.2.forwarding.onlyforissuer.1=cn=My CA,o=ACME Inc,c=SE\nresponder.2.forwarding.responseWhenInvalidResponseFromBackEndClient=internalerror","type":"text"}]},{"type":"paragraph","content":[{"text":"These three settings are also available:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This setting allows the back end client to modify the request before it is sent to another responder. OCSP forwarding really means \"send the message, as it is, to another responder\".","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"responder..forwarding.modify-request=[true|false]","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This setting defines a match table for what issuers that OCSP forwarding should be enabled for. <","type":"text"},{"text":"issuermatch","type":"text","marks":[{"type":"code"}]},{"text":"> is matched against the issuer DN. Wildcards are allowed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..forwarding.onlyforissuer.=","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the back end client receives a valid response, this response is sent to the requesting client and the validation is finished. The parameter ","type":"text"},{"text":"responseWhenInvalidResponseFromBackEndClient","type":"text","marks":[{"type":"code"}]},{"text":" controls what Nexus OCSP Responder will do if the back end client failed to retrieve a valid response.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"unknown ","type":"text","marks":[{"type":"code"}]},{"text":"to have Nexus OCSP Responder not respond, but rather continue with other modules, such as CRL/CIL checks. This will most likely result in an \"unknown\" response to the client. Note that this will cause Nexus OCSP Responder to sign the response using the default signer for that responder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"trylater","type":"text","marks":[{"type":"code"}]},{"text":" to have Nexus OCSP Responder pass back \"Try later\" in the OCSP response.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"internalerror","type":"text","marks":[{"type":"code"}]},{"text":" to have Nexus OCSP Responder pass back \"Internal error\" in the OCSP response.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"trylater","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"responder..forwarding.responseWhenInvalidResponseFromBackEndClient=[unknown|trylater|internalerror]","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify freshness proof","type":"text"}]},{"type":"paragraph","content":[{"text":"For a description of the freshness proof functionality, see ","type":"text"},{"text":"Freshness proof","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349020"}}]},{"text":".","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows for ","type":"text"},{"text":"type=identrus-cached","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder..freshnessproof.add=[true|false]","type":"text"}]},{"type":"paragraph","content":[{"text":"See this table for description of constants and values:","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"cc4375b1-0da1-4247-a667-41e5e6319c93"},"marks":[{"type":"fragment","attrs":{"name":"Table 6","localId":"cd57e185-ef09-4572-a0d3-ba6783eb5133"}}],"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Constants and Values","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the responder sequence number.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true | false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Enter ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":" to add, ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" not to not add freshness proof.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify system control","type":"text"}]},{"type":"paragraph","content":[{"text":"You can configure Nexus OCSP Responder to automatically shut down if an internal error occurs (when the sent OCSP response has internal error status).","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder.numberOfConsecutiveInternalErrorsBeforeShutdown=","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the number of consecutive internal error responses to return before shutting the system down. A value below 1 disables the functionality.","type":"text"}]},{"type":"paragraph","content":[{"text":"Default value: ","type":"text"},{"text":"-1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Specify ping data","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the OCSP configuration file, specify ping data as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"responder.pingdata=","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with a string. When an incoming HTTP POST message contains this data in its body, Nexus OCSP Responder will respond with a simple HTTP 200 OK message and no logs will be produced. This can typically be used by a load balancer to frequently check that the server is up without producing excessive log files in Nexus OCSP Responder.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Examples","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"View examples","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Nexus OCSP responder configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"In the following examples, different responders are configured. Note that these examples are not complete configurations of the Nexus OCSP Responder.","type":"text"}]},{"type":"codeBlock","content":[{"text":"; OCSP Responder configuration\n; This responder supports Basic OCSP CA\nresponder.1.type=basic\nresponder.1.url=http://*:8080/1\nresponder.1.workers=5\nresponder.1.connections=2000\nresponder.1.signature.chain=cert\nresponder.1.signer.1.issuerdn=c=SE,cn=Basic OCSP CA\nresponder.1.signer.1.certificate=c=SE,cn=Basic OCSP Signer\nresponder.1.signer.1.pin=1234\nresponder.1.billing.enabled=true\nresponder.1.billing.percert=true\nresponder.1.billing.perrequest=true\nresponder.1.billing.countunknown=true\nresponder.1.billing.includestatus=true\n\n; This responder supports Test CA A, B and C\n; Signing algorithm set to SHA256withRSA\nresponder.2.type=basic\nresponder.2.url=http://*:8080/2\nresponder.2.workers=5\nresponder.2.connections=2000\nresponder.2.signature.chain=cert\nresponder.2.signer.1.issuerdn=c=SE,o=Nexus,cn=Test CA A\nresponder.2.signer.1.certificate=c=SE,O=Nexus,cn=Test CA A Signer\nresponder.2.signer.1.signingalgorithm=SHA256withRSA\nresponder.2.signer.1.pin=1234\nresponder.2.signer.2.issuerdn=c=SE,o=Nexus,cn=Test CA B\nresponder.2.signer.2.certificate=c=SE,O=Nexus,cn=Test CA B Signer\nresponder.2.signer.2.signingalgorithm=SHA256withRSA\nresponder.2.signer.2.pin=1234\nresponder.2.signer.3.issuerdn=c=SE,o=Nexus,cn=Test CA C\nresponder.2.signer.3.certificate=c=SE,O=Nexus,cn=Test CA C Signer\nresponder.2.signer.3.signingalgorithm=SHA256withECDSA\nresponder.2.signer.3.pin=1234\nresponder.2.signer.4.issuerdn=c=SE,o=Nexus,cn=Test CA D\nresponder.2.signer.4.certificate=c=SE,O=Nexus,cn=Test CA D Signer\nresponder.2.signer.4.signingalgorithm=Ed25519\nresponder.2.signer.4.pin=1234\n\n\n; Specify the PKCS#12 key stores for the different signing certificates.\nkey.store.store.1=basic-ca-signer.p12\nkey.store.store.1.pin=secretPIN1234\nkey.store.store.2=generic-integration-test-ca-a-signer.p12\nkey.store.store.2.pin=secretPIN1234\nkey.store.store.3=generic-integration-test-ca-b-signer.p12\nkey.store.store.3.pin=secretPIN1234\nkey.store.store.4=generic-integration-test-ca-c-signer.p12\nkey.store.store.4.pin=secretPIN1234\nkey.store.store.5=generic-integration-test-ca-d-signer.p12\nkey.store.store.5.pin=secretPIN1234","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Nexus OCSP responder proxy configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this sample configuration to set up Nexus OCSP Responder to forward all incoming OCSP requests to another (OCSP) responder:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example 1","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"; This responder supports all CAs and forwards to another responder\nresponder.1.type=basic\nresponder.1.url=http://*:8080/1\nresponder.1.workers=5\nresponder.1.connections=2000\nresponder.1.signature.chain=cert\nresponder.1.signer.1.issuerdn=c=SE,cn=Basic OCSP CA\nresponder.1.signer.1.certificate=c=SE,cn=Basic OCSP Signer\nresponder.1.signer.1.pin=1234\nresponder.1.forwarding.enabled = true\nresponder.1.forwarding.onlyforissuer.1=*\n\n; Configure the ocsp client for this responder\nresponder.1.forwarding.client.request.usecache=false\nresponder.1.forwarding.client.request.http.method=post\nresponder.1.forwarding.client.request.signature.chain=none\nresponder.1.forwarding.client.response.allowunknown=true\nresponder.1.forwarding.client.response.signature.check=false\nresponder.1.forwarding.client.response.chain.validate=false\nresponder.1.forwarding.client.urlcheck.1 = table\nresponder.1.forwarding.client.urlcheck.1.table.1.url = http://otherhost:8080/\nresponder.1.forwarding.client.urlcheck.1.table.1.issuermatch = *\n\n; Specify the PKCS#12 key store for the signing certificate.\nkey.store.store.1=basic-ca-signer.p12\nkey.store.store.1.pin=secretPIN1234","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this sample configuration to set up Nexus OCSP Responder to forward all incoming OCSP requests to another (OCSP) responder using client authentication:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example 2","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"; This rsponder supports all CAs and forwards to another responder\nresponder.1.type=basic\nresponder.1.url=http://*:8080/1\nresponder.1.workers=5\nresponder.1.signature.chain=cert\nresponder.1.signer.1.issuerdn=c=SE,cn=Basic OCSP CA\nresponder.1.signer.1.certificate=c=SE,cn=Basic OCSP Signer\nresponder.1.signer.1.pin=1234\nresponder.1.forwarding.enabled = true\nresponder.1.forwarding.onlyforissuer.1 = *\n\n; Configure the ocsp client for this responder\nresponder.1.forwarding.client.urlcheck.1 = table\nresponder.1.forwarding.client.urlcheck.1.table.1.url = https://otherhost:8444\nresponder.1.forwarding.client.urlcheck.1.table.1.issuermatch = *\nresponder.1.forwarding.client.authentication.key.certificate=c=SE,cn=TLS Client\nresponder.1.forwarding.client.authentication.key.pin=1234\n\n; Specify the PKCS#12 key store for the signing and TLS certificate.\nkey.store.store.1=basic-ca-signer.p12\nkey.store.store.1.pin=secretPIN1234\nkey.store.store.2=tls-client.p12\nkey.store.store.2.pin=1234","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Related information","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access control and billing","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65348755"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Back end client section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045649"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Nexus OCSP Responder","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045505"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Distinguished name matching","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65351192"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Freshness proof","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349020"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key management section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045964"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Introduction to LDAP","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65349545"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Nexus OCSP Responder","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65345982"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OCSP response cache section","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045809"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Trust store","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/ID/pages/689045711"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Java Cryptography Architecture Standard Algorithm Name Documentation for JDK 8","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html"}}]}]}]}]}],"version":1}

Browser not supported