Revocation checking mechanisms
Ensuring the ongoing validity of digital certificates is an integral part of maintaining a secure Public Key Infrastructure (PKI) environment. This section delves into the primary mechanisms for checking the revocation status of a certificate: Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP), both supported on the . These methods provide essential tools for verifying whether a certificate has been revoked before trusting its authenticity. Understanding the workings of these revocation checking mechanisms enables effective management and validation of digital certificates, contributing significantly to the overall security of the PKI system.
The supports the management and export of Certificate Revocation Lists (CRLs). Use these lists to manage single or mass certificates that must be revoked for various reasons, including those defined by third-party Certificate Authorities (CAs).
To create a CRL:
Log in to the application interface with an identity assigned the required permissions.
Go to PKI > Certificate Authorities.
Right-click the certificate for which you want to create a CRL and select CRL > Create.
In the Create CRL window, modify the CRLs information per your requirements.
Select [ OK ] to save.
To export a CRL:
Log in to the application interface with an identity assigned the required permissions.
Go to PKI > Certificate Authorities.
Right-click the certificate for which you want to export the CRL and select CRL > Export.
In the CRL Export windoet the desired CRL Period, Encoding, Format, and file save location.
Select [ OK ] to initiate the CRL export.
Online Certificate Status Protocol (OCSP) is an internet protocol for obtaining the revocation status of an X.509 digital certificate. It serves as an alternative to CRLs, primarily to address performance issues.
In a PKI environment, it's essential to know whether a particular digital certificate is still valid or has been revoked (due to reasons such as a compromised private key). CRLs provide this information, but as the list grows, it becomes increasingly inefficient to download and parse.
OCSP addresses this by allowing a client to query the certificate status in real-time directly from a server maintained by the Certificate Authority (CA). The OCSP server returns a response indicating whether the certificate is still valid, has been revoked, or is unknown to the responder.
This protocol enables applications to obtain timely information regarding the revocation status of certificates, improving the overall performance and scalability of certificate validation processes.
To configure OCSP on the , perform the following steps:
Go to Administration > Configuration > Network Options.
Go to TLS/SSL Settings, located at the top of the Network Options window.
Select OCSP in the Connection drop-down menu.
Set the following options:
Option
Required configuration
Port
Use the default port of 80
Enabled
Checked
Select [ OK ].
Go to Administration > Configuration > OCSP Options.
Set the following options:
Option
Required configuration
Request Signature
Unchecked
Responding
Use issuer as responder
Responder ID
Key
Response Signature
Checked
Signing hash algorithm
SHA-1
Included certificates
Signer Certificate
None required
Unchecked
Select [ Save ].