Enabling or disabling OCSP using the CLI

Use the CLI commands in this section to enable or disable the Online Certificate Status Protocol (OCSP) so that the appliance can verify the status of the certificate revocation. When OCSP is enabled and the appliance cannot reach the OCSP server, the user is denied access to the Web UI.

Note

OCSP is enabled by default.

To enable OCSP:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Enable OCSP for certificate authentication.

hostname (config) # aaa authentication certificate ocsp enable

Verify the status of OCSP.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : required

  Certificate field for username : x509-cert-subject-cn

  CA certificate bundle          : client-cert-auth

 OCSP enabled                   : yes

...

Save your changes.
```
hostname (config) # write memory
```

To disable OCSP:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Disable OCSP for certificate authentication.

hostname (config) # no aaa authentication certificate ocsp enable

Verify the status of OCSP.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : required

  Certificate field for username : x509-cert-subject-cn

  CA certificate bundle          : client-cert-auth

  OCSP enabled                   : no

...

Save your changes.
```
hostname (config) # write memory
```