system certificate ocsp-responder
Use this command to create the OCSP responder.
To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For details, see Permissions.
The OCSP responder is referenced in system certificate verify.
Syntax
config system certificate ocsp-responder
edit <ocsp-group_name>
set ocsp-url <string>
set ocsp-signing-certs-grp <string>
set timeout <integer>
set comment <string>
set caching {enable | disable}
set caching-ttl <integer>
next
end
| Variable | Description | Default |
|
<ocsp-responder_name> |
Enter the name of an OCSP responder. The maximum length is 63 characters. | No default. |
|
ocsp-url <string> |
Enter the URL of the OCSP Responder. |
No default. |
| ocsp-signing-certs-grp <string> |
Select the OCSP signing certificate group you have created. |
No default. |
|
timeout <integer> |
Specify the timeout of the OCSP query. The valid range is 1 - 30. |
2 (seconds) |
|
comment <string> |
Enter the comment for this reponsder. |
No default. |
|
caching {enable | disable} |
Enable to cache the OCSP responses for a defined period (set by the Caching TTL). FortiWeb can quickly retrieve the validation status from the cache rather than querying the OCSP responder every time, |
Disable |
|
caching-ttl <integer> |
Caching TTL (Time to Live) is the duration for which the "This Update" timestamp in the OCSP response is considered valid. It’s important to note that the "This Update" timestamp does not indicate the exact time when FortiWeb first requests the OCSP responder to validate a specific client certificate. Instead, it reflects the time of the OCSP responder's last periodic check of the certificate's status. For example, if the OCSP responder last checked the client certificate status at 13:30, the "This Update" timestamp will show 13:30, even if FortiWeb requests validation of the client certificate for the first time at 14:00. This design allows FortiWeb to use the OCSP responder’s most recent validation result, improving efficiency by avoiding unnecessary revalidation while ensuring timely, accurate certificate status checks. The valid range is 1800 - 604800. This option is available only when |
3600 (seconds) |