>
    Enable an HTTP Proxy for OCSP Status Checks
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Certificate Management
    4. Certificate Revocation
    5. Enable an HTTP Proxy for OCSP Status Checks
    Download PDF

    Enable an HTTP Proxy for OCSP Status Checks

    Table of Contents

    Enable an HTTP Proxy for OCSP Status Checks

    Configure your web proxy to send and receive OCSP requests and status responses.
    If your network deployment consists of a web proxy, you can configure Online Certificate Status Protocol (OCSP) to validate certificates. All OCSP requests and responses will pass through your proxy server. The benefits of checking certificate status using OCSP instead of or in addition to certificate revocation lists (CRLs) include real-time status responses and reduced usage of network and client resources.
    The workflow of OCSP certificate validation through a web proxy is as follows:
    1. An authenticating client (firewall) forwards an OCSP request to the proxy. The request contains the serial number for the certificate the client wants to validate.
    2. The proxy validates the request and identifies the OCSP responder for the certificate authority (CA) that issued the certificate.
    3. The proxy forwards the OCSP request to the responder, and the OCSP responder looks up the revocation status for the certificate in the CA database.
    4. The OCSP responder sends the certificate status (
      good
      ,
      revoked
      , or
      unknown
      ) to the proxy.
    5. The proxy forwards the certificate status to the client.
    The following procedure assumes you have not set up a web proxy.
    1. Configure a proxy server.
      1. Go to
        Device
        Setup
        Services
        , and edit the Services settings.
      2. Edit the Proxy Server settings.
        • For
          Server
          , enter the IP address or host name of the proxy server.
        • Enter a
          Port
          .
        • For
          User
          , enter a username that an administrator enters to access the proxy server.
        • Enter and confirm a
          Password
           that an administrator enters to access the proxy server.
        You can also use the following CLI commands to configure your proxy server for OCSP status checks (and CRL downloads).
        • set deviceconfig system secure-proxy-server
          <value>
        • set deviceconfig system secure-proxy-port
          <1-65535>
        • set deviceconfig system secure-proxy-user
          <value>
        • set deviceconfig system secure-proxy-password
          <value>

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.