A validator can be of type: CRL or CIL.

• In the OCSP configuration file, specify as follows:

  ocsp.validation.<v#>.type=[crl|cil]

  Description of constants and values:

  Constants and Values	Description
  <v#>	Replace <v#> with the validator sequence number.
  crl | cil	Enter crl to indicate that the validator shall work with the CRL cache. Enter cil to indicate that the validator shall work with the CIL cache.

For each validator:

• Specify at least one provider to keep the CRL cache constantly up-to-date. This can be done by pull or push methods:
  
  • type=pull - Periodically polling a directory for new CRL versions. Note that pull is not available for CILs.
  • type=push - Waiting for incoming CRLs/CILs, pushed from a CA, for example, Nexus Certificate Manager.

For each provider, specify as follows in the OCSP configuration file:

ocsp.validation.<v#>.provider.<p#>.type=[pull|push]

Description of constants and values:

CRL providers with type=pull are not available for CILs.

The CA that provides the directory service can supply one or more alternative site(s). If so, you can specify a list of URLs.

1. For each CRL provider with type=pull, configure how to find the directory. This can be done by the use of either the LDAP/LDAPS protocol or the HTTP/HTTPS protocol. Identify the specifications for each site by a URL sequence number. In the OCSP configuration file, specify as follows:

   ocsp.validation.<v#>.provider.<p#>.url.<u#>=
   	[[ldap|ldaps]://<host>[:<port>]/<dn>?
   		[certificaterevocationlist|deltacertificaterevocationlist]] |
   		[[http|https]://<host>[:<port>]/<path>]

2. If login is required for a certain provider you must specify the parameters ...username and ...password.

   ocsp.validation.<v#>.provider.<p#>.url.<u#>.username=<user name>
   ocsp.validation.<v#>.provider.<p#>.url.<u#>.password=<password>
   ocsp.validation.<v#>.provider.<p#>.period=<time expr>
   ocsp.validation.<v#>.provider.<p#>.ignoreIDP=[true|false]

   Description of constants and values:

   Constants and Values	Description
   <v#>	Replace <v#> with the validator sequence number.
   <p#>	Replace <p#> with the provider sequence number.
   <u#>	Replace <u#> with the URL sequence number.
   ldap | ldaps	Enter ldap to indicate that the LDAP protocol shall be used (TLS is not needed). Enter ldaps to indicate that the LDAPS protocol shall be used (TLS is needed).
   <host>[:<port>]	Replace <host> with the name of the directory host. Replace <port> with the port number (if needed).
   <dn>	Replace <dn> with the distinguished name of the directory entry.
   certificaterevocationlist | deltacertificaterevocationlist	Enter certificaterevocationlist if the URL provides full CRLs. Enter deltacertificaterevocationlist if the URL provides delta CRLs.
   http | https	Enter http to indicate that the HTTP protocol shall be used (TLS is not needed). Enter https to indicate that the HTTPS protocol shall be used (TLS is needed).
   <host>[:<port>]/<path>	Replace <host> with the name of the directory host and <path> with the path to use. Replace <port> with the port number (if needed).
   <user name>	Replace <user name> with the user name that is required for this directory.
   <password>	Replace <password> with the password that is required in combination with <user name> for this directory.
   <time expr>	Replace <time expr> with a time period expression (short form), specified according to ISO 8601 Representation of dates and times. (see section “Specify OCSP client request” in Back end client section). This value will set the periodicity of updates. Default: PT1H
   true | false	The CRL may contain an Issuing Distribution Point (IDP) extension. IDP marks a CRL as being incomplete, and thus reliable revocation queries cannot be answered from it. If you have out of band information that a CRL with an IDP is indeed complete, you may force Nexus OCSP Responder to accept this CRL. If an IDP extension exists and ignoreIDP is set to true, always accept the CRL. If an IDP extension exists and ignoreIDP is set to false, reject the CRL. In both cases a message will be written to the log file. Default: false

   Example:

   ocsp.validation.1.type=crl
   ocsp.validation.1.provider.1.type=pull
   ocsp.validation.1.provider.1.url.1=
   	ldap://directory/cn=Test CA2,
   		o=Nexus OCSP Responder,
   		c=se?certificaterevocationlist
   ocsp.validation.1.provider.1.url.1.username=cn=admin,c=se
   ocsp.validation.1.provider.1.url.1.password=****
   ocsp.validation.1.provider.1.url.2=http://backuphost.com/testca2.crl
   ocsp.validation.1.provider.1.period=P1D

• For each provider with type=push, specify as follows in the OCSP configuration file:
  
  

  ocsp.validation.<v#>.provider.<p#>.listen.url=<URL>
  ocsp.validation.<v#>.provider.<p#>.ignoreIDP=[true|false]
  ocsp.validation.<v#>.provider.<p#>.ssl.clientauth=[true|false]
  ocsp.validation.<v#>.provider.<p#>.ssl.certificate=<certificate pattern>
  ocsp.validation.<v#>.provider.<p#>.ssl.pin=<PIN>
  ocsp.validation.<v#>.provider.<p#>.ssl.cipher=<cipher suites>
  ocsp.validation.<v#>.provider.<p#>.ssl.protocol=<protocols>

  Description of constants and values:

  Constants and Values	Description
  <v#>	Replace <v#> with the validator sequence number.
  <p#>	Replace <p#> with the provider sequence number.
  <URL>	Replace <URL> with the URL the provider shall listen to (HTTP or HTTPS only).
  <certificate pattern>	If HTTPS is used, a key and certificate needs to be specified. See Key management section.
  <PIN>	If HTTPS is used, a key and certificate needs to be specified. See Key management section.
  true | false for parameter ..ignoreIDP	The CRL/CIL may contain an Issuing Distribution Point (IDP) extension. IDP marks a CRL/CIL as being incomplete, and thus reliable revocation queries cannot be answered from it. If you have out of band information that a CRL/CIL with an IDP is indeed complete, you may force Nexus OCSP to accept this CRL/CIL. If an IDP extension exists and ignoreIDP is set to true, always accept the CRL/CIL. If an IDP extension exists and ignoreIDP is set to false, reject the CRL/CIL. In both cases a message will be written to the log file. Default: false
  true | false for parameter ..ssl.clientauth	If client TLS authentication is required, set this to true (HTTPS only). If client TLS authentication is not required, set this to false. Default: false
  <cipher suites> for parameter ..ssl.cipher	A comma separated list of TLS cipher suites that should be enabled. If HTTPS is enabled, then limit the number of enabled cipher suites to a subset of the default. If no ciphers are specified all the following default will be enabled: TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256
  <protocols> for parameter ..ssl.protocol	A comma separated list of TLS protocols that should be enabled. If HTTPS is enabled, then limit the number of enabled security protocols to a subset of the default. If no protocols are specified the following default will be enabled: TLSv1.3 TLSv1.2

  Example:

  ocsp.validation.1.type=cil
  ocsp.validation.1.provider.3.type=push
  ocsp.validation.1.provider.3.listen.url=http://ocsphost.com:87/