I have successfully configured OpenSSL OCSP responder with this hierarchy: RootCA > OCSP responder (signed by RootCA).
I have deployed a trustpoint (named RootCA) into the ASA with the RootCA public key. So I expect that ASA will be trusted to OCSP, because it's trusted by RootCA which has a signed OCSP key. But seems it is not. Due to VPN client connection I have.
CRYPTO_PKI: Blocking chain callback called for OCSP response <...> status: 2
I get the above debug message, which indicates a problem with the certificate signer, according to BRKSEC-3053
So, I imported the OCSP key into a separate trustpoint (named OCSP) and created a certificate map with an overriding OCSP rule. The revocation check hierarchy now looks like this:
VPN client > RootCA > certificate map > OCSP responder.
With that scheme, the OCSP responses are trusted and revocation check completed successfully.
My questions are:
- Do we really need a separate trustpoint for OCSP signing key?
- Or this is expected behavior with OCSP responder implementation in OpenSSL?
- Or maybe I have missed something important?