2

Online Certificate Status Protocol for the BIG-IP System

• Introducing OCSP
• How does OCSP on the BIG-IP system work?
• Configuring OCSP

Introducing OCSP

Online Certificate Status Protocol (OCSP) is an industry-standard protocol that offers an alternative to a certificate revocation list (CRL) when using public-key technology. A CRL is a list of revoked client certificates, which a server system can check during the process of verifying a client certificate.

With this release, the BIG-IP system supports both CRLs and the OCSP protocol, for use with its SSL proxy feature.

For more information on CRLs, see the BIG-IP Reference Guide .

The limitations of CRLs

When presented with a client certificate, the BIG-IP system sometimes needs to assess the revocation state of that certificate before accepting the certificate and forwarding the connection to a target server. The standard method of assessing revocation status is a CRL, which is stored in a separate CRL file on each machine in your configuration. Although CRLs are considered to be a standard way of checking revocation status of SSL certificates, a CRL is updated only at fixed intervals, thus presenting a risk that the information in the CRL is outdated at the time that the status check occurs.

Also, having to store a separate CRL file on each machine presents other limitations:

• All CRL files must be kept in sync.
• Having a separate CRL file on each machine poses a security risk.
• Multiple CRL files cannot be administered from a central location.

The benefits of OCSP

OCSP ensures that the BIG-IP system always obtains real-time revocation status during the certificate verification process.

OCSP is based on a client/server model. A BIG-IP SSL proxy acts as the OCSP client, and the OCSP server runs on an external system. (The OCSP server is a third-party software application and is therefore not included in the BIG-IP system.)

The external system, known as an OCSP responder, sends certificate revocation status to the SSL proxy. Until the SSL proxy receives this status from the OCSP responder, the proxy blocks the connection. If the OCSP responder rejects the certificate, the proxy denies the connection.

Figure 2.1 shows a basic OCSP implementation in a BIG-IP system configuration.

Figure 2.1 A basic OCSP configuration

How does OCSP on the BIG-IP system work?

Before using OCSP, you must configure the OCSP client and the OCSP responder to work together. Configuring OCSP means creating a responder definition on the BIG-IP system, and then associating that responder definition with one or more SSL proxies. A responder definition is a set of data and instructions on the BIG-IP system that the corresponding responder needs when servicing an OCSP client request.

When a client sends a certificate to the BIG-IP system, the SSL proxy first checks that the signer of the certificate is listed in the trusted CAs file. If the certificate is listed, the BIG-IP system then checks to see if the certificate has been revoked. Without OCSP, the BIG-IP system can check revocation status by reading the certificate revocation list (CRL), if the CRL option is configured on the SSL proxy. With OCSP, however, the BIG-IP system bypasses the CRL and sends a revocation status request to the appropriate OCSP responder.

The BIG-IP system chooses the OCSP responder by checking the CA specified in the Issuer field of the original client certificate. The BIG-IP system then attempts to match that CA with a CA listed in the responder definitions associated with that SSL proxy. The responder definition that the BIG-IP system uses is a definition listed in the OCSP responder list option of the SSL proxy.

If a match exists, the BIG-IP system checks the target URL within the client certificate's AuthorityInfoAccess (AIA) field, if the field exists. The BIG-IP system then uses that URL, unless the Ignore AIA parameter is enabled within the responder definition. In this case, the BIG-IP system uses the URL specified in the Responder URL parameter of the matching responder definition to send the request for certificate revocation status.

If no match exists, the BIG-IP system checks the Responder CAs parameter of another responder defined in the SSL proxy. If all responder definitions are checked and no match is found, the certificate verification fails and the BIG-IP system denies the client request.

Configuring OCSP

Using the BIG-IP system, you can create OCSP responder definitions that correspond to various responders. The BIG-IP system stores responder definitions in the bigip.conf file. Figure 2.2 shows an example of a responder definition.

Figure 2.2 Sample responder definition in the bigip.conf file

A single responder definition can target a specific responder, or multiple responder definitions can target the same responder. The only unique attribute is the responder name. Each responder itself is associated with a certificate authority (CA), and multiple responders can be associated with the same CA.

Figure 2.3 shows this scenario, where responders 1 and 2 are associated with CA 1, but responder 3 is associated with CA 2.

Figure 2.3 Relationship of responders to CAs

Once you have created all of your responder definitions, you can configure an SSL proxy to use one or more specific responder definitions when processing requests over SSL.

There are two tasks required for configuring OCSP. The first task is to create the OCSP responder definition. The second task is to configure the SSL proxy's OCSP responder list option. This option allows you to specify the OCSP responder definitions that the proxy will use to obtain revocation status.

Creating an OCSP responder definition

To fully implement a responder definition on the BIG-IP system, you must define a set of parameter values. You configure these parameters through the bigpipe responder command. Table 2.1 lists and describes the configurable parameters for a responder definition.

To create a responder definition

Use the following bigpipe responder command syntax to create an OCSP responder definition.

b responder <name> [calist file <filename>]
[url <url>]
[valperiod <number>]
[respcert file <filename>]
[signcert file <filename>]
[signkey file <filename>]
[req sign digest (sha1 | md5)]
[req certid digest (sha1 | md5)]
[ignore aia (enable | disable)]
[trust signer (enable | disable)]

To view responder definition parameters

Use the following commands, specifying a responder name, to show responder parameter values.

b responder <name> calist file [show]
b responder <name> url [show]
b responder <name> valperiod [show]
b responder <name> respcert file [show]
b responder <name> signcert file [show]
b responder <name> signkey file [show]
b responder <name> req sign digest [show]
b responder <name> req certid digest [show]
b responder <name> ignore aia [show]
b responder <name> trust signer [show]

Configuring the SSL proxy

Once you have created one or more OCSP responder definitions, you need to specify which responder definition the SSL proxy should use when it responds to the BIG-IP system's request for certificate revocation status. You do this by using the bigpipe proxy command to configure the OCSP responder list option.

If the OCSP responder list option is not configured on the SSL proxy, then the certificate is automatically validated.

Table 2.2 describes the OCSP responder list option.

After you have configured the OCSP responder list option, and the BIG-IP system has received certificate revocation status from a responder, the SSL proxy inserts a certificate status header into the original client request. Note that the SSL proxy only inserts this header when previously configured to insert headers into client requests. (For more information on configuring this option, see the BIG-IP Reference Guide ).

The name of the certificate status header is SSLClientCertificateStatus. Like other certificate-related headers that the proxy inserts into a request, the SSLClientCertificateStatus header is most useful when the proxy is configured to request, but not require, certificates. For more information on configuring the SSL proxy, see the BIG-IP Reference Guide .

To configure the SSL proxy for OCSP validation

Use the following bigpipe proxy command syntax to configure the OCSP responder list option.

b proxy <ip addr>:<service> [ocsp responders <list of responders>]

To display a list of existing OCSP responders

Use the following bigpipe proxy command syntax to display a list of existing OCSP responders.

proxy <ip addr>:<service> ocsp responders [show]

Note