Certificate Authority
Futurex Online Issuing CA

Revocation checking mechanisms

5min

Ensuring the ongoing validity of digital certificates is an integral part of maintaining a secure Public Key Infrastructure (PKI) environment. This section delves into the primary mechanisms for checking the revocation status of a certificate: Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP), both supported on the . These methods provide essential tools for verifying whether a certificate has been revoked before trusting its authenticity. Understanding the workings of these revocation checking mechanisms enables effective management and validation of digital certificates, contributing significantly to the overall security of the PKI system.

Certificate Revocation Lists

The supports the management and export of Certificate Revocation Lists (CRLs). Use these lists to manage single or mass certificates that must be revoked for various reasons, including those defined by third-party Certificate Authorities (CAs).

Creating CRLs

To create a CRL:

1

Log in to the application interface with an identity assigned the required permissions.

2

Go to PKI > Certificate Authorities.

3

Right-click the certificate for which you want to create a CRL and select CRL > Create.

4

In the Create CRL window, modify the CRLs information per your requirements.

5

Select [ OK ] to save.

Exporting CRLs

To export a CRL:

1

Log in to the application interface with an identity assigned the required permissions.

2

Go to PKI > Certificate Authorities.

3

Right-click the certificate for which you want to export the CRL and select CRL > Export.

4

In the CRL Export windoet the desired CRL Period, Encoding, Format, and file save location.

5

Select [ OK ] to initiate the CRL export.

Online Certificate Status Protocol (OCSP)

Online Certificate Status Protocol (OCSP) is an internet protocol for obtaining the revocation status of an X.509 digital certificate. It serves as an alternative to CRLs, primarily to address performance issues.

In a PKI environment, it's essential to know whether a particular digital certificate is still valid or has been revoked (due to reasons such as a compromised private key). CRLs provide this information, but as the list grows, it becomes increasingly inefficient to download and parse.

OCSP addresses this by allowing a client to query the certificate status in real-time directly from a server maintained by the Certificate Authority (CA). The OCSP server returns a response indicating whether the certificate is still valid, has been revoked, or is unknown to the responder.

This protocol enables applications to obtain timely information regarding the revocation status of certificates, improving the overall performance and scalability of certificate validation processes.

Configure OCSP Server on the KMES Series 3

To configure OCSP on the , perform the following steps:

1

Go to Administration > Configuration > Network Options.

2

Go to TLS/SSL Settings, located at the top of the Network Options window.

3

Select OCSP in the Connection drop-down menu.

4

Set the following options:

Option

Required configuration



Port

Use the default port of 80



Enabled

Checked


5

Select [ OK ].

6

Go to Administration > Configuration > OCSP Options.

7

Set the following options:

Option

Required configuration



Request Signature

Unchecked



Responding

Use issuer as responder



Responder ID

Key



Response Signature

Checked



Signing hash algorithm

SHA-1



Included certificates

Signer Certificate



None required

Unchecked


8

Select [ Save ].