apm aaa ocsp¶

apm aaa ocsp(1) BIG-IP TMSH Manual apm aaa ocsp(1)

NAME
ocsp - Configure Online Certificate System Protocol (OCSP) responder objects.

MODULE
apm aaa

SYNTAX
Configure the ocsp component within the aaa module using the syntax shown in the following sections.

edit ocsp | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties

DISPLAY
list ocsp
list ocsp [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition

DELETE
delete ocsp [name]

DESCRIPTION
To implement the SSL OCSP authentication module, create an OCSP responder object and assign it to the OCSP
auth agent in your access policy.

OPTIONS
allow-certs
Specifies whether the addition of certificates to an OCSP request is enabled. The default is true.

app-service
Specifies the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.

ca-file
Specifies the name of the certificate file object containing trusted CA certificates used to verify the
signature on the OCSP response. The default is none.

ca-path
Specifies the path to the trusted CA certificates used to verify the signature on the OCSP response. The
default is none.

cert-id-digest
The cert ID digest is part of the OCSP protocol. The OCSP client (in this case, the BIG-IP system)
calculates the cert ID using a hash of the Issuer and serial number for the certificate that it is trying
to verify. The options are:

sha1 Newer algorithm that provides a higher security level with a 160 bit hash length. This is the
default.

md5 Older algorithm with a 128 bit hash length.

chain
Specifies whether the system constructs a chain from certificates in the OCSP response. The default is
true.

check-certs
Specifies whether the LTM system makes additional checks to see if the signer's certificate is authorized
to provide the necessary status information. Use this option only for testing purposes. The default is
true.

explicit-ocsp
Specifies whether the BIG-IP system explicitly trusts that the OCSP response signer's certificate is
authorized for OCSP response signing. If the signer's certificate does not contain the OCSP signing
extension, setting this option to true causes a response to be untrusted. The default is true.

ignore-aia
Specifies whether to ignore the URL contained in the certificate's AIA fields, and to always use the URL
specified by the responder instead. The default is false.

intern
Specifies whether to ignore certificates contained in an OCSP response when searching for the signer's
certificate. When you set this option to true, you must also specify the signer's certificate using
either the verify-other or va-file option. The default is true.

location-specific
Specifies whether or not this object contains one or more attributes with values that are specific to the
location where the BIG-IP device resides. The location-specific attribute is either true or false. When
using policy sync, mark an object as location-specific to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specific to a certain location.

[name]
Specifies a unique name for the component. This option is required.

nonce
Specifies whether a nonce will be sent in an OCSP request. When set to false, the request is sent without
a nonce. The default is true.

partition
Displays the partition within which the OCSP responder object resides.

sign-digest
Specifies the algorithm (md5 or sha1> used to sign a request using a signing certificate and key. The
default is sha1. If you use this option, you must also set the sign-key and sign-key-passphrase options.

sign-key
Specifies the key used to sign an OCSP request. If you use this option, you must also set the sign-digest
and sign-key-passphrase options. The default is none.

sign-key-passphrase
Specifies the passphrase for the signing key. If you use this option, you must also set the sign-digest
and sign-key options. The default is none.

sign-other
Specifies additional certificates to add to an OCSP request. The options are default.crt and
ca-bundle.crt. The default is none.

signer
Specifies the certificate used to sign an OCSP request. If the certificate is specified but the key is
not specified, then the private key is read from the same file as the certificate. If neither the
certificate nor the key is specified, then the request is not signed. If the certificate is not specified
and the key is specified, then the configuration is considered to be invalid. The default is none.

status-age
Species the amount of time (in seconds) to compare to the notBefore value of a status response. Use this
option only when a status response does not include the notAfter field. The default is 0 (zero).

trust-other
Specifies whether the BIG-IP system trusts the certificates specified using the verify-other option. The
default is false.

url Specifies the URL used to contact the OCSP service on the responder. This option is required. The default
is none.

va-file
Specifies the name of the file containing explicitly-trusted responder certificates. Use this option when
the responder is not covered by the certificates already loaded into the responder's CA store. The
default is none.

validity-period
Specifies an acceptable error range in seconds. Use this option when the OCSP responder clock and a
client clock are not synchronized, which could cause a certificate status check to fail. This value must
be a positive number. This option is required. The default is 300.

verify
Specifies whether verification of an OCSP response signature or the nonce values is enabled. Use this
option only for debugging purposes. The default is true.

verify-cert
Specifies whether the BIG-IP system verifies the certificate in the OCSP response. The default is true.

verify-other
Specifies the name of the file used to search for an OCSP response signing certificate when the
certificate has been omitted from the response. The default is none.

verify-sig
Specifies whether the BIG-IP system checks the signature on the OCSP response. Use this option only for
testing purposes. The default is true.

SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

BIG-IP 2016-01-07 apm aaa ocsp(1)