Fortinet Document Library

Version:

Version:


Table of Contents

Handbook

Download PDF
Copy Link

OCSP stapling

OCSP stapling is an improved approach to OCSP for verifying the revocation status of certificates. Rather than having the client contact the OCSP server to validate the certificate status each time it makes a request, FortiADC can be configured to periodically query the OCSP server and cache a time-stamped OCSP response for a set period. The cached response is then included, or "stapled," with the TLS/SSL handshake so that the client can validate the certificate status when it makes a request.

This method of verifying the revocation status of certificates shifts the resource cost in providing OCSP responses from the client to the presenter of a certificate. In addition, because fewer overall queries to the OCSP responder will be made when OCSP stapling is configured, the total resource cost in verifying the revocation status of certificates is also reduced. FortiADC allows you to upload an OCSP response file, configure an OCSP to let FortiADC download the OCSP response from the OCSP server, or both.

Before you begin, you must:

To configure OCSP stapling:
  1. Go to System > OCSP.
  2. Click the OCSP Stapling tab.
  3. Click + Import to display the configuration editor.
  4. Complete the configuration as described in OCSP stapling configuration.
  5. Click Save.

OCSP stapling configuration

Settings Guidelines
Name Enter the mkey.
Local Certificate Select the local certificate to add to the OCSP stapling configuration.
Issuer Certificate Select the CA certificate to add to the OCSP stapling configuration.
OCSP Select the OCSP configuration to add to the OCSP stapling configuration. If an OCSP configuration is not selected, import an OCSP Response from a file (see below). You can both select an OCSP configuration and upload an OCSP response file; in this case, FortiADC will first use the OCSP response file and then automatically update using the OCSP configuration.
Response Update Ahead Time

Available only when you select an OCSP configuration. This option is meaningful only when the next update field in the OCSP response is present in a selected OCSP stapling response.

Enter the time before the next scheduled update at which FortiADC will start the download for the next update. The default value is 1 hour.

Response Update Interval

Available only when you select an OCSP configuration. Enter the next update interval if the downloaded OCSP response is the same or FortiADC fails to download the new OCSP response. The default value is 5 minutes.

If the next update field in the OCSP response is not present, FortiADC will attempt to download the next update periodically according to this parameter.

OCSP Response Enable to import an OCSP response from a file. PEM and DER formats are supported.
To configure OCSP stapling using the CLI:

config system certificate OCSP_stapling

edit <ocsp_stapling_name>

set OCSP

set OCSP-response

set issuer-certificate

set local-certificate

set response-update-ahead-time

set response-update-interval

 

Note: When configuring OCSP stapling in the CLI, only PEM format file types are supported.

OCSP stapling

OCSP stapling is an improved approach to OCSP for verifying the revocation status of certificates. Rather than having the client contact the OCSP server to validate the certificate status each time it makes a request, FortiADC can be configured to periodically query the OCSP server and cache a time-stamped OCSP response for a set period. The cached response is then included, or "stapled," with the TLS/SSL handshake so that the client can validate the certificate status when it makes a request.

This method of verifying the revocation status of certificates shifts the resource cost in providing OCSP responses from the client to the presenter of a certificate. In addition, because fewer overall queries to the OCSP responder will be made when OCSP stapling is configured, the total resource cost in verifying the revocation status of certificates is also reduced. FortiADC allows you to upload an OCSP response file, configure an OCSP to let FortiADC download the OCSP response from the OCSP server, or both.

Before you begin, you must:

To configure OCSP stapling:
  1. Go to System > OCSP.
  2. Click the OCSP Stapling tab.
  3. Click + Import to display the configuration editor.
  4. Complete the configuration as described in OCSP stapling configuration.
  5. Click Save.

OCSP stapling configuration

Settings Guidelines
Name Enter the mkey.
Local Certificate Select the local certificate to add to the OCSP stapling configuration.
Issuer Certificate Select the CA certificate to add to the OCSP stapling configuration.
OCSP Select the OCSP configuration to add to the OCSP stapling configuration. If an OCSP configuration is not selected, import an OCSP Response from a file (see below). You can both select an OCSP configuration and upload an OCSP response file; in this case, FortiADC will first use the OCSP response file and then automatically update using the OCSP configuration.
Response Update Ahead Time

Available only when you select an OCSP configuration. This option is meaningful only when the next update field in the OCSP response is present in a selected OCSP stapling response.

Enter the time before the next scheduled update at which FortiADC will start the download for the next update. The default value is 1 hour.

Response Update Interval

Available only when you select an OCSP configuration. Enter the next update interval if the downloaded OCSP response is the same or FortiADC fails to download the new OCSP response. The default value is 5 minutes.

If the next update field in the OCSP response is not present, FortiADC will attempt to download the next update periodically according to this parameter.

OCSP Response Enable to import an OCSP response from a file. PEM and DER formats are supported.
To configure OCSP stapling using the CLI:

config system certificate OCSP_stapling

edit <ocsp_stapling_name>

set OCSP

set OCSP-response

set issuer-certificate

set local-certificate

set response-update-ahead-time

set response-update-interval

 

Note: When configuring OCSP stapling in the CLI, only PEM format file types are supported.