OCSP Responder with Self-Signed Certificate

fhewiufhwefhwe — Thu, 02 Jul 2020 16:13:09 GMT

Following https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK, I created an OCSP responded. When creating the user certificates, for signed by I tried both the Root and Intermediate certificate. I allowed HTTP_OCSP on both device->setup->Interfaces->Management as well as Network->Interfaces->Network Profiles->Interface Mgmt that corresponds to my interface. I also created a security policy to all ocsp from my machine to the firewall.

From the CLI, when I typed in the command: debug sslmgr view ocsp all

Nothing is coming back however. Any idea what could be the problem?

Do I have to download the certificate and try to use it with vpn before the debug sslmgr view oscp all command will show anything?

Re: OCSP Responder with Self-Signed Certificate

fhewiufhwefhwe — Sun, 05 Jul 2020 12:25:02 GMT

Finally figured out the missing step from another article. I need to go to Device -> Setup -> Session -> Decryption Certificate Revocation Settings

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/certificate-management/set-up-verification-for-certificate-revocation-status/configure-revocation-status-verification-of-certificates-used-for-ssltls-decryption.html

topic Re: OCSP Responder with Self-Signed Certificate in General Topics

OCSP Responder with Self-Signed Certificate

Re: OCSP Responder with Self-Signed Certificate