Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

An OCSP responder is not part of a SSL server; it is maintained by the Certification Authority which issued the certificate for the SSL server. Indeed, the OCSP responder publishes information on the revocation status for certificates, and it is the CA who chooses which certificate is revoked and which is not.

Thus, OCSP responders usually come with the software for managing the CA. See for instance EJBCA, an Open Source PKI, which comes with its own OCSP responder. There are also stand-alone responders, which feed on CRL produced by the CA; see for instance this one.

Either way, an OCSP responder is only good as far as validators talk to it. Software trying to validate a certificate, in particular a Web browser which acts as client to your server, will use a given OCSP responder only if they know that it exists and where to find it. In practice, this means that the URL to the OCSP responder has to be included in the certificate itself, as part of an Authority Information Access extension. Of course, it is up to the CA to include, or not, such an extension in the certificate, when it issues it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.