Support for OCSP Verification through HTTP Proxy
Table of Contents
11.0 (EoL)
Expand all | Collapse all
End-of-Life (EoL)
Support for OCSP Verification through HTTP Proxy
HTTP proxy servers can inspect and forward OCSP requests and responses to OCSP
responders and authenticating clients.
PAN-OS 11.0 adds support for Online Certificate Status Protocol (OCSP)
certificate revocation checks through HTTP/S proxies. If your network deployment
consists of a web proxy, you can configure OCSP to validate certificates. All OCSP
requests and responses will pass through your proxy server. The benefits of checking
certificate status using OCSP instead of or in addition to certificate revocation lists (CRLs)
include real-time status responses and reduced usage of network and client
resources.
The workflow of OCSP certificate validation through a web proxy is as follows:
- An authenticating client (firewall) forwards an OCSP request to the proxy. The request contains the serial number for the certificate the client wants to validate.
- The proxy validates the request and identifies the OCSP responder for the certificate authority (CA) that issued the certificate.
- The proxy forwards the OCSP request to the responder, and the OCSP responder looks up the revocation status for the certificate in the CA database.
- The OCSP responder sends the certificate status (good, revoked, or unknown) to the proxy.
- The proxy forwards the certificate status to the client.
The following procedure assumes you have not set up a web
proxy.
- Configure an HTTP proxy (DeviceSetupServices).You can use the following CLI commands to configure a proxy server for OCSP status checks (and CRL downloads).
- set deviceconfig system secure-proxy-server <value>
- set deviceconfig system secure-proxy-port <1-65535>
- set deviceconfig system secure-proxy-user <value>
- set deviceconfig system secure-proxy-password <value>
Configure an OCSP responder.If your enterprise has its own public key infrastructure (PKI), you can configure a firewall as an OCSP responder.