SG and OCSP Service

[Ihenock1011]

Hi All,

Is there a case where security gateways check the OCSP service for obtaining the revocation status of an X.509 digital certificate? In what case will the gateway do that?

Thanks

[Lesley]

If you have it configured it can do OCSP, default is CRL.

You can check the CRL URL in the certificate itself. 

https://support.checkpoint.com/results/sk/sk37803

For HTTPS inspection:

Does HTTPS Inspection check for CRLs? What about OCSP?

Yes. By default, the CRL check is done on the certificate.
The check is done without holding the connection, so the first time a user accesses a specific site, it will pass without CRL validation, and the next connection will be validated.
By default, if the CRL can't be reached, the certificate is considered to be trusted (this is also the default behavior of the common browsers).

If you wish to enforce CRL fetch, and to mark the certificate as untrusted, if the CRL can not be reached, you can use GuiDBedit Tool to change the value of attribute "drop_if_crl_cannot_be_reached" to "true" (Tables -> "Other" -> "SSL Inspection" table -> "general_confs_obj" Object).

OCSP is supported from R80.10 and from Jumbo Hotfix Accumulator for R77.30 (Take 266).

Config related to HTTPS: SmartConsole -> Manage & settings -> blades -> all the way down , configure in SmartDashboard (https inspection).
Then in legacy SmartDashboard go to HTTPS inspection tab and then trusted CA's.
Here you can change settings related to CA updates. 

[PhoneBoy]

It happens with HTTPS traffic passing through the gateway as part of the SNI verification process.
It also happens with VPNs.