- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: SG and OCSP Service
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SG and OCSP Service
Hi All,
Is there a case where security gateways check the OCSP service for obtaining the revocation status of an X.509 digital certificate? In what case will the gateway do that?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you have it configured it can do OCSP, default is CRL.
You can check the CRL URL in the certificate itself.
https://support.checkpoint.com/results/sk/sk37803
For HTTPS inspection:
Does HTTPS Inspection check for CRLs? What about OCSP?
Yes. By default, the CRL check is done on the certificate.
The check is done without holding the connection, so the first time a user accesses a specific site, it will pass without CRL validation, and the next connection will be validated.
By default, if the CRL can't be reached, the certificate is considered to be trusted (this is also the default behavior of the common browsers).If you wish to enforce CRL fetch, and to mark the certificate as untrusted, if the CRL can not be reached, you can use GuiDBedit Tool to change the value of attribute "drop_if_crl_cannot_be_reached" to "true" (Tables -> "Other" -> "SSL Inspection" table -> "general_confs_obj" Object).
OCSP is supported from R80.10 and from Jumbo Hotfix Accumulator for R77.30 (Take 266).
Config related to HTTPS: SmartConsole -> Manage & settings -> blades -> all the way down , configure in SmartDashboard (https inspection).
Then in legacy SmartDashboard go to HTTPS inspection tab and then trusted CA's.
Here you can change settings related to CA updates.
If you like this post please give a thumbs up(kudo)! 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It happens with HTTPS traffic passing through the gateway as part of the SNI verification process.
It also happens with VPNs.