topic OCSP query in General Topics

OCSP query

conceptelectronics — Thu, 04 Apr 2013 15:54:20 GMT

Hi,

We are implementing a SSL-VPN solution using Global Protect and our own CA. From what I have seen the OCSP queries are made on demand, when the certificate is presented for the first time, and then at a fixed interval(60 minutes). I tried changing the interval using the "debug sslmgr set ocsp-next-update-time" but did not have any effect on the update interval.

I wanted to test the PKI infrastructure and modify the state of a certain certificate. Even though I cleared the ocsp cache "debug sslmgr delete ocsp all", when I used the certificate for witch PA had cached a oscp query(that I deleted earlier) PA used the old state of the certificate.

Is there any other way to effectively clear the ocsp cache, or modify the ocsp update time?

Thanks,

Costin

Re: OCSP query

zarina — Thu, 04 Apr 2013 19:25:28 GMT

You can clear the cache using the following commands:

On MP:

debug sslmgr delete ocsp

On DP:

debug dataplane reset ssl-decrypt certificate-cache, or

debug dataplane reset ssl-decrypt certificate-status

Re: OCSP query

conceptelectronics — Fri, 05 Apr 2013 10:14:05 GMT

Thanks,

That solved the cache clearing problem, but I still have an issue with the ocsp update time.

And also there is a difference in the time showed on the device and in the ocsp debug.

admin@pa5050(active)> debug sslmgr view ocsp all

Current time is: Fri Apr 5 10:19:48 2013

Count Serial Number (HEX) Status Next Update Revocation Time Reason

Issuer Name Hash

OCSP Responder URL

------- ---------------------------------------- ----------- ------------------------ ------------------------ ----------

[ 1] 15BA94EB8D8B7993 valid Apr 11 15:02:34 2013 GMT

09b9f61a

http://tpp.sniep.ro/ocsp

admin@pa5050(active)> show clock

Fri Apr 5 13:19:55 EEST 2013

admin@pa5050(active)>

Re: OCSP query

zarina — Mon, 08 Apr 2013 16:46:26 GMT

The current time is listed in UTC whereas the clock is listed per the time zone configured on the device. I will have to look for the update time issue.