ejbca-develop

[Ejbca-develop] Missing OCSP Url in Certificate

[Ronald O. <ro...@ke...>]

Hi,

I have successfully setup EJBCA on two boxes to serve the functions of 
both CA and OCSP on separate servers. The OCSP server answers correctly 
for certificates issued from the CA server.

My problem is that when I execute the below command to try and establish 
if an issued certificate has na OCSP Url, none is printed out and I 
believe it should be part of the certificate.

openssl x509 -noout -ocsp_uri -in TestUser.pem

What could I have missed in the configuration?

Cheers.

Ronald.

Re: [Ejbca-develop] Missing OCSP Url in Certificate

[Michael S. <mi...@st...>]

Ronald Osure wrote:
> I have successfully setup EJBCA on two boxes to serve the functions of both CA
> and OCSP on separate servers. The OCSP server answers correctly for
> certificates issued from the CA server.
> 
> My problem is that when I execute the below command to try and establish if an
> issued certificate has na OCSP Url, none is printed out and I believe it
> should be part of the certificate.
> 
> openssl x509 -noout -ocsp_uri -in TestUser.pem
> 
> What could I have missed in the configuration?

OCSP responder URLs are configured in the certificate profile.

For better flexibility with HA setup of external OCSP responders I would *not*
use the automatically generated URLs.

Ciao, Michael.

Re: [Ejbca-develop] Missing OCSP Url in Certificate

[Ronald O. <ro...@ke...>]

Hi Michael,

Thanks for the response. On which section/form field of the certificate 
profiles is this done? I am using EJBCA 6.2.0.
I am using a clean custom url in the format ocsp.example.com and I have 
configured Apache as a  Reverse proxy to handle the communication with 
the JBOSS server.

On 05/25/2015 12:58 PM, Michael Ströder wrote:
> Ronald Osure wrote:
>> I have successfully setup EJBCA on two boxes to serve the functions of both CA
>> and OCSP on separate servers. The OCSP server answers correctly for
>> certificates issued from the CA server.
>>
>> My problem is that when I execute the below command to try and establish if an
>> issued certificate has na OCSP Url, none is printed out and I believe it
>> should be part of the certificate.
>>
>> openssl x509 -noout -ocsp_uri -in TestUser.pem
>>
>> What could I have missed in the configuration?
> OCSP responder URLs are configured in the certificate profile.
>
> For better flexibility with HA setup of external OCSP responders I would *not*
> use the automatically generated URLs.
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Missing OCSP Url in Certificate

[Michael S. <mi...@st...>]

Ronald Osure wrote:
> Thanks for the response. On which section/form field of the certificate
> profiles is this done? I am using EJBCA 6.2.0.

The X.509v3 extension is called "Authority Information Access".

I don't have a running EJBCA instance at home. But IIRC the input fields are
expanded if you enable a check box.

Ciao, Michael.

Re: [Ejbca-develop] Missing OCSP Url in Certificate

[Ronald O. <ro...@ke...>]

Hi Michael,

Works like charm! Thank you so much.

Ronald.

On 05/25/2015 01:43 PM, Michael Ströder wrote:
> Ronald Osure wrote:
>> Thanks for the response. On which section/form field of the certificate
>> profiles is this done? I am using EJBCA 6.2.0.
> The X.509v3 extension is called "Authority Information Access".
>
> I don't have a running EJBCA instance at home. But IIRC the input fields are
> expanded if you enable a check box.
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop