sys crypto cert-validator ocsp

sys crypto cert-validator ocsp(1)		  BIG-IP TMSH Manual		    sys crypto cert-validator ocsp(1)

NAME
       ocsp - Configuration of the OCSP cert-validator.

MODULE
       sys crypto

SYNTAX
       Configure the ocsp component within the sys.crypto.cert-validator.ocsp module using the syntax shown in the
       following sections. This object is associated with a certificate object to enable an OCSP request for updating
       the certificate status.

   CREATE/MODIFY
	 create ocsp [name]
	 modify ocsp [name]
	   options:
	     cache-error-timeout [integer]
	     cache-timeout [indefinite | [integer] ]
	     concurrent-connections-limit [integer]
	     clock-skew [integer]
	     description [string]
	     dns-resolver [name]
	     proxy-server-pool [name]
	     responder-url [none | [string] ]
	     route-domain [name]
	     sign-hash [sha1 | sha256]
	     signer-cert [name]
	     signer-key [name]
	     signer-key-passphrase [none | [string] ]
	     status-age [integer]
	     strict-resp-cert-check [disabled | enabled]
	     timeout [indefinite | [integer] ]
	     trusted-responders [none | [name] ]

   DISPLAY
	 list ocsp [name]

   DELETE
	 delete  [all | [name]]
	   options:
	     recursive

DESCRIPTION
       You can use the ocsp component to create, modify, display or delete a custom OCSP cert-validator.

       The OCSP cert-validator is associated with a certificate object.

EXAMPLES
       create cert-validator my_ocsp dns-resolver name

       Creates an OCSP cert-validator named my_ocsp using the DNS resolver specified by name.

OPTIONS
       cache-error-timeout
	    Specifies the lifetime of an error response in the cache, in seconds. The default value is 3600 seconds.

       cache-timeout
	    Specifies the lifetime of the OCSP response in the cache, in seconds. The actual time period for which
	    the response is cached is the minimum of the response validity period and the cache-timeout. The default
	    value is indefinite, indicating that the response validity period takes precedence.

       concurrent-connections-limit
	    Specifies the maximum number of connections per second allowed for the OCSP cert-validator.

       clock-skew
	    Specifies the tolerable absolute difference in the clocks of the responder and the BIG-IP, in seconds.
	    The default value is 300.

       description
	    User defined description.

       dns-resolver
	    Specifies the DNS resolver object used for fetching the OCSP response.

       partition
	    Displays the administrative partition within which this validator resides.

       proxy-server-pool
	    Specifies the proxy server pool used for fetching the OCSP response.

       responder-url
	    Specifies the absolute URL that overrides the OCSP responder URL obtained from the certificate's AIA
	    extension(s). This should be an HTTP-based URL.

       route-domain
	    Specifies the route domain for fetching an OCSP response using HTTP forward proxy.

       sign-hash
	    Specifies the hash algorithm used for signing the OCSP request. The default value is sha256.

       signer-cert
	    Specifies the certificate corresponding to the key used for signing the OCSP request.

       signer-key
	    Specifies the key used for signing the OCSP request.

       signer-key-passphrase
	    Specifies the passphrase of the key used for signing the OCSP request.

       status-age
	    Specifies the maximum allowed lag time for the 'thisUpdate' time in the OCSP response that the BIG-IP
	    accepts. If this maximum is exceeded, the response is dropped. If this value is set to 0, this validation
	    is skipped. The default value is 86400 seconds.

       strict-resp-cert-check
	    If enabled, the responder's certificate is checked for an OCSP signing extension. The default value is
	    disabled.

       timeout
	    Specifies the time interval (in seconds) that the BIG-IP waits for before ending the connection to the
	    OCSP responder. The default value is 8.

       trusted-responders
	    Specifies the certificates used for validating the OCSP response when the responder's certificate has
	    been omitted from the response.

SEE ALSO
       create, delete, list, modify, tmsh

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or by any means, electronic or
       mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
       other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2013-2016. All rights reserved.

BIG-IP						      2017-01-20		    sys crypto cert-validator ocsp(1)