User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
151
OCSP cache learning is enabled by default
(
AutoLearningEnabled: Y ), which configures the internal
RADIUS server to save information learned from OCSP
responses to the OCSP cache. If a response pertains to an
existing cache entry, the entry is updated or refreshed. If a
response pertains to a new certificate, an entry is created for
the certificate in the OCSP cache.
When learning is disabled (
AutoLearningEnabled: N ), the
internal RADIUS server will attempt to validate a certificate only
when an entry for it is already present in the OCSP cache.
Disable learning if you do not want to automatically
authenticate new users on the network.
Manually add OCSP cache entries for digital certificates with
the
add command:
# add ocspcache -searchtext <uniqueSubjectSubstring>
Typically, -searchtext specifies a substring of the Common
Name component of the certificate’s Subject field. It must
identify the certificate without ambiguity. If a matching manual
entry is present for a new certificate, it will be sent to the OCSP
responder for validation, even when OCSP cache learning is
disabled.
# show ocspcache
OCSP Cache (ValidityPeriod: 168 hours, AutoLearningEnabled: Y, TotalEntries: 1)
Index Common Name Search Text Status
------ ------------------- ------------------- -----------------
1 ou=engineering,dc= Not yet validated
The Not yet validated Status of an entry manually added
to the OCSP cache will be overwritten by the first actual
Status value received for the matching certificate from the
OCSP responder, and the certificate’s
Common Name will be
recorded in the entry.
OCSP cache entries are identified by
-index number or
-searchtext string, which, once established, cannot be
changed. Use these switches with an entry’s
Index number or
Search Text string, respectively, to identify an entry for
update. Alternatively, you can use
-all to apply an update to
every entry in the cache.
Use
update ocspcache with -renew to refresh an OCSP cache
entry—or
-all entries in the cache—to the currently configured
ValidityPeriod (described above).
# update ocspcache -index <Index#> |-searchtext <uniqueSubjectSubstring>| -all -renew
Use update ocspcache with -expire to mark an OCSP cache
entry—or
-all entries in the cache—immediately expired.
# update ocspcache -index <Index#> |-searchtext <uniqueSubjectSubstring> |-all -expire