Configuring OCSP Certificate Status
Configuring Online Certificate Status Protocol (OCSP) involves adding an OCSP responder, binding the OCSP responder to a signed certificate from a Certificate Authority (CA), and binding the certificate and private key to a Secure Sockets Layer (SSL) virtual server. If you need to bind a different certificate and private key to an OCSP responder that you already configured, you need to first unbind the responder and then bind the responder to a different certificate.
To configure OCSP
-
On the Configuration tab, in the navigation pane, expand SSL and then click OCSP Responder.
-
In the details pane, click Add.
-
In Name, type a name for the profile.
-
In URL, type the web address of the OCSP responder.
This field is mandatory. The Web address cannot exceed 32 characters.
-
To cache the OCSP responses, click Cache and in Time-out, type the number of minutes that NetScaler Gateway holds the response.
-
Under Request Batching, click Enable.
-
In Batching Delay, specify the time, in milliseconds, allowed for batching a group of OCSP requests.
The values can be from 0 through 10000. The default is 1.
-
In Produced At Time Skew, type the amount of time NetScaler Gateway can use when the appliance needs to check or accept the response.
-
Under Response Verification, select Trust Responses if you want to disable signature checks by the OCSP responder.
If you enable Trust Responses, skip Step 8 and Step 9.
-
In Certificate, select the certificate that is used to sign the OCSP responses.
If a certificate is not selected, the CA that the OCSP responder is bound to is used to verify responses.
-
In Request Time-out, type the number of milliseconds to wait for an OCSP response.
This time includes the Batching Delay time. The values can be from 0 through 120000. The default is 2000.
-
In Signing Certificate, select the certificate and private key used to sign OCSP requests. If you do not specify a certificate and private key, the requests are not signed.
-
To enable the number used once (nonce) extension, select Nonce.
-
To use a client certificate, click Client Certificate Insertion.
-
Click Create and then click Close.