Debugging OCSP query errors

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Debugging OCSP query errors

L1 Bithead

Our GlobalProtect setup does OCSP checking of client certificates, to an internal OCSP-server.  Every once in a while, the lookup fails (as in no response from server, connection denied, or whatever), and the client is denied access (Gateway Required client certificate is not found).  There will be successful lookups just before and just after the failing lookups.  I'm well aware that this might be/probably is a problem with my internal network, but I'd still like to know for certain why the lookups fail...

Is there a way to find out what kind of error the PA firewall is seeing?  (Connection timeout, 404, etc)

We're running 6.1.1, with GP 2.1.2

The sslmgr log shows the following:

2015-03-30 11:00:24.754 +0200 [OCSP] URL http://ocsp-server/ocsp      serialno: 48xxx

2015-03-30 11:00:24.754 +0200 debug: pan_ocsp_fetch_ocsp(pan_crl.c:1992): [0] OCSP checking ... depth 0, URI: http://ocsp-server/ocsp

2015-03-30 11:00:24.754 +0200 debug: pan_ocsp_certchain_to_file(pan_crl.c:1147): root_ca_fname(xxx)

2015-03-30 11:00:24.771 +0200 debug: pan_ocsp_query_responder(pan_crl.c:1917): certificate valid time information (Issuer: Not Before[Mar 16 07:27:31 2010 GMT]; Not After[Jan 19 14:08:09 2020 GMT]; Cert: Not

Before[Jan 20 16:20:38 2015 GMT]; Not After[Jan 20 16:20:38 2016 GMT];)

2015-03-30 11:00:24.771 +0200 debug: pan_ocsp_parse_response(pan_crl.c:1269): Error querying OCSP responder

2015-03-30 11:00:24.771 +0200 Error:  pan_ocsp_parse_response(pan_crl.c:1312): Failed to query OCSP responsder

2015-03-30 11:00:24.771 +0200 Error:  pan_ocsp_parse_response(pan_crl.c:1355): [OCSP] The result of Certificate status query is unavailable for serial number[48xxx] and uri[http://ocsp-server/ocsp]

2015-03-30 11:00:24.771 +0200 Error:  pan_ocsp_fetch_ocsp(pan_crl.c:2104): pan_ocsp_parse_response() failed

2015-03-30 11:00:24.771 +0200 debug: sslmgr_check_status(sslmgr_main.c:801): [0] OCSP check result is 'unavailable', depth 0

2015-03-30 11:00:24.771 +0200 debug: sslmgr_check_status(sslmgr_main.c:1007): [0] final status: unavailable; reason: error querying OCSP responder; depth: 0; BY OCSP

2015-03-30 11:00:24.771 +0200 Send cookie:18 session:0 status:3 to DP

debug sslmgr view ocsp http://ocsp-server/ocsp also just gives "unavailable" as status, with time of last check as "next update" time.  Retrying the connection ("Rediscover network") doesn't necessarily help, which leads me to believe that the PA caches 'unavailable'-repsonses (which may not always be what you want)?  I haven't tried flushing the OCSP cache, but this problem only happens once in a while, and most of the time goes away by itself immediately (because the next OCSP request succeeds)

Opinions or suggestions, anyone?

  • 0 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!