I have successfully configured OpenSSL OCSP responder with this hierarchy: RootCA > OCSP responder (signed by RootCA).

I have deployed a trustpoint (named RootCA) into the ASA with the RootCA public key. So I expect that ASA will be trusted to OCSP, because it's trusted by RootCA which has a signed OCSP key. But seems it is not. Due to VPN client connection I have.

CRYPTO_PKI: Blocking chain callback called for OCSP response <...> status: 2

I get the above debug message, which indicates a problem with the certificate signer, according to BRKSEC-3053

So, I imported the OCSP key into a separate trustpoint (named OCSP) and created a certificate map with an overriding OCSP rule. The revocation check hierarchy now looks like this:

VPN client > RootCA > certificate map > OCSP responder.

With that scheme, the OCSP responses are trusted and revocation check completed successfully.

My questions are:

  1. Do we really need a separate trustpoint for OCSP signing key?
  2. Or this is expected behavior with OCSP responder implementation in OpenSSL?
  3. Or maybe I have missed something important?

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.