OCSP query

Showing results for 
Show  only  | Search instead for 
Did you mean: 

OCSP query


We are implementing a SSL-VPN solution using Global Protect and our own CA. From what I have seen the OCSP queries are made on demand, when the certificate is presented for the first time, and then at a fixed interval(60 minutes). I tried changing the interval using the "debug sslmgr set ocsp-next-update-time" but did not have any effect on the update interval.

I wanted to test the PKI infrastructure and modify the state of a certain certificate. Even though I cleared the ocsp cache "debug sslmgr delete ocsp all", when I used the certificate for witch PA had cached a oscp query(that I deleted earlier) PA used the old state of the certificate.

Is there any other way to effectively clear the ocsp cache, or modify the ocsp update time?




L5 Sessionator

You can clear the cache using the following commands:

On MP:

debug sslmgr delete ocsp

On DP:

debug dataplane reset ssl-decrypt certificate-cache, or

debug dataplane reset ssl-decrypt certificate-status


That solved the cache clearing problem, but I still have an issue with the ocsp update time.

And also there is a difference in the time showed on the device and in the ocsp debug.

admin@pa5050(active)> debug sslmgr view ocsp all

Current time is: Fri Apr  5 10:19:48 2013

Count   Serial Number (HEX)                      Status      Next Update              Revocation Time          Reason   

        Issuer Name Hash

        OCSP Responder URL

------- ---------------------------------------- ----------- ------------------------ ------------------------ ----------

[    1] 15BA94EB8D8B7993                         valid       Apr 11 15:02:34 2013 GMT                         



admin@pa5050(active)> show clock

Fri Apr  5 13:19:55 EEST 2013


The current time is listed in UTC whereas the clock is listed per the time zone configured on the device. I will have to look for the update time issue.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!