OCSP query

[conceptelectronics]

Hi,

We are implementing a SSL-VPN solution using Global Protect and our own CA. From what I have seen the OCSP queries are made on demand, when the certificate is presented for the first time, and then at a fixed interval(60 minutes). I tried changing the interval using the "debug sslmgr set ocsp-next-update-time" but did not have any effect on the update interval.

I wanted to test the PKI infrastructure and modify the state of a certain certificate. Even though I cleared the ocsp cache "debug sslmgr delete ocsp all", when I used the certificate for witch PA had cached a oscp query(that I deleted earlier) PA used the old state of the certificate.

Is there any other way to effectively clear the ocsp cache, or modify the ocsp update time?

Thanks,

Costin

[zarina]

You can clear the cache using the following commands:

On MP:

debug sslmgr delete ocsp

On DP:

debug dataplane reset ssl-decrypt certificate-cache, or

debug dataplane reset ssl-decrypt certificate-status

[conceptelectronics]

Thanks,

That solved the cache clearing problem, but I still have an issue with the ocsp update time.

And also there is a difference in the time showed on the device and in the ocsp debug.

admin@pa5050(active)> debug sslmgr view ocsp all

Current time is: Fri Apr  5 10:19:48 2013

Count   Serial Number (HEX)                      Status      Next Update              Revocation Time          Reason   

        Issuer Name Hash

        OCSP Responder URL

------- ---------------------------------------- ----------- ------------------------ ------------------------ ----------

[    1] 15BA94EB8D8B7993                         valid       Apr 11 15:02:34 2013 GMT                         

        09b9f61a

        http://tpp.sniep.ro/ocsp

admin@pa5050(active)> show clock

Fri Apr  5 13:19:55 EEST 2013

admin@pa5050(active)>

[zarina]

The current time is listed in UTC whereas the clock is listed per the time zone configured on the device. I will have to look for the update time issue.