Skip to main content
Ensuring the ongoing validity of digital certificates is an integral part of maintaining a secure Public Key Infrastructure (PKI) environment. This section delves into the primary mechanisms for checking the revocation status of a certificate: Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP), both supported on the KMES Series 3. These methods provide essential tools for verifying whether a certificate has been revoked before trusting its authenticity. Understanding the workings of these revocation checking mechanisms enables effective management and validation of digital certificates, contributing significantly to the overall security of the PKI system.

​
Certificate Revocation Lists

The KMES Series 3 supports the management and export of Certificate Revocation Lists (CRLs). Use these lists to manage single or mass certificates that must be revoked for various reasons, including those defined by third-party Certificate Authorities (CAs).

​
Create CRLs

Perform the following steps to create a CRL:
1
Log in to the KMES Series 3 application interface with an identity assigned the required permissions.
2
Go to PKI > Certificate Authorities.
3
Right-click the certificate for which you want to create a CRL and select CRL > Create.
4
In the Create CRL window, modify the CRLs information per your requirements.
5
Select [ OK ] to save.

​
Export CRLs

Perform the following steps to export a CRL:
1
Log in to the KMES Series 3 application interface with an identity assigned the required permissions.
2
Go to PKI > Certificate Authorities.
3
Right-click the certificate for which you want to export the CRL and select CRL > Export.
4
In the CRL Export window, set the desired CRL Period, Encoding, Format, and file save location.
5
Select [ OK ] to initiate the CRL export.

​
Online Certificate Status Protocol (OCSP)

Online Certificate Status Protocol (OCSP) is an internet protocol for obtaining the revocation status of an X.509 digital certificate. It serves as an alternative to CRLs, primarily to address performance issues. In a PKI environment, it’s essential to determine whether a particular digital certificate is still valid or has been revoked due to reasons such as a compromised private key. CRLs provide this information, but as the list grows, it becomes increasingly inefficient to download and parse. OCSP addresses this by enabling a client to query the certificate status in real-time directly from a server maintained by the Certificate Authority (CA). The OCSP server returns a response indicating whether the certificate is still valid, has been revoked, or is unknown to the responder. This protocol enables applications to obtain timely information regarding the revocation status of certificates, improving the overall performance and scalability of certificate validation processes.

​
Configure OCSP server

To configure OCSP on the KMES, perform the following steps:
1
Go to Administration > Configuration > Network Options.
2
Go to TLS/SSL Settings, located at the top of the Network Options window.
3
Select OCSP in the Connection drop-down menu.
4
Set the following options:
OptionRequired configuration
PortUse the default port of 80
EnabledChecked
5
Select [ OK ].
6
Go to Administration > Configuration > OCSP Options.
7
Set the following options:
OptionRequired configuration
Request SignatureUnchecked
RespondingUse issuer as responder
Responder IDKey
Response SignatureChecked
Signing hash algorithmSHA-1
Included certificatesSigner Certificate
None requiredUnchecked
8
Select [ Save ].