Keeping revocation information up to date

Support

Go to the table of contents

Go to the previous page

Go to the next page

Go to the index

View or print as PDF

Working With Encrypted Data > Keeping revocation information up to date

Keeping revocation information up to date

Help | Content Gateway | Version 7.7.3

It is recommended that before your site accepts certificates, it checks the status of the certificate to ensure that it has not been revoked. There are two methods of doing this: through CRLs (see Certificate revocation lists) and through OCSP (see Online certification status protocol (OCSP)).

Certificate revocation lists

Use the Configure > SSL > Validation > Revocation Settings page to configure how SSL Manager keeps revocation information current. By default, SSL Manager downloads CRLs on a daily basis.

1.	For daily downloads of the CRLs, select Download the CRL at, and select the time when the CRL download occurs.

2.	Click Apply.

Use this page as well if you need an immediate CRL update.

1.	Click Update CRL Now to download the CRLs at a time other than that specified. For example, if your subscription includes SSL Manager, download the CRLs after you install the program.


	Note The CRL files can contain thousands of certifications, so downloading CRLs can take some time and consume CPU resources. It is recommended that you download CRLs at a time when Internet traffic on your system is light.

2.	Click View CRL Update Progress to see the status of the update.

For more information on certificate revocation lists, see RFC 3280.

Online certification status protocol (OCSP)

OCSP is a protocol that operates on a request/response basis. That is, when a site wants to verify the revocation status of a certificate, it sends a request to the CA about the status of the certificate. The CA then responds, confirming the validity (or revocation) of the certificate.

OCSP, because it is dealing with requests, rather than downloading CRLs, can provide improved performance. However, not all CAs provide responses, so CRLs can provide information about the status of more certificates.

SSL Manager enables you to cache OCSP responses about the revocation state of a certificate. Caching responses may be useful in environments with high amounts of SSL traffic and where saving bandwidth is important.

Use the Configure > SSL > Validation > Revocation Settings page to configure how SSL Manager keeps revocation information current.

1.	Specify, in days, how long OCSP data should be cached. If you do not want to cache OCSP data, enter 0. The maximum is 1000 days

2.	Click Apply.

For more information on OCSP, see RFC 2560.

Go to the table of contents

Go to the previous page

Go to the next page

Go to the index

View or print as PDF

Working With Encrypted Data > Keeping revocation information up to date