Ubuntu Manpage: pki --ocsp - OCSP request parser and OCSP responder.

Provided by: strongswan-pki_5.9.13-2ubuntu4_amd64

NAME

       pki --ocsp - OCSP request parser and OCSP responder.

SYNOPSIS

       pki --ocsp [--in file] [--cacert file] [--debug level]

       pki --ocsp --respond [--in file] --cacert file --key file [--cert file] [--index file]
                  [--lifetime minutes] [--digest digest] [--rsa-padding padding] [--debug level]

       pki --ocsp --options file

       pki --ocsp -h | --help

DESCRIPTION

       This  sub-command of pki(1) parses an Online Certificate Status Protocol (OCSP) request as defined by RFC
       6960 and with the --respond option generates an OCSP response based on the OCSP request.  The certificate
       status for this may be provided by plugins so if not using the --index option,  this  currently  requires
       the  openxpki  and  mysql  plugins  in  order  to directly access the internal certificate database of an
       OpenXPKI (https://openxpki.org) server.

OPTIONS

-h, --help
Print usage information with a summary of the available options.

-v, --debug level
Set debug level, default: 1.

-+, --options file
Read command line options from file.

-i, --in file
OCSP request. If not given, the OCSP request is read from STDIN.

-C, --cacert file
CA certificate corresponding to one of the issuer hashes contained in the OCSP request. If the
OCSP request is signed, a CA certificate forming the trust chain. Can be used multiple times.

-k, --key file
OCSP signer key. Can be used multiple times.

-c, --cert file
OCSP signer certificate (if it is not a CA certificate). Can be used multiple times.

-x, --index file
OpenSSL-style index.txt providing information about the status of certificates issued by the CA
certificate loaded immediately before. Can be used multiple times if the status for multiple CAs
should be provided, just make sure to pass each index.txt file right after the corresponding CA
certificate.

See below for a description of the structure of these files.

-l, --lifetime minutes
Validity in minutes of the OCSP response (if missing, nextUpdate is omitted).

-g, --digest digest
Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or sha512,
sha3_224, sha3_256, sha3_384, sha3_512. The default is determined based on the type and size of
the OCSP signing key.

-R, --rsa-padding padding
Padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1.

INDEX.TXT DESCRIPTION

Each line in an index.txt file consists of six columns that are separated by tab characters:

The first column denotes the certificate status, which can be either "V" (for valid), "E" (for expired,
treated like valid), or "R" (for revoked).

The second column contains the certificate's expiration date and time in UTC in the format YYMMDDHHMMSSZ.
This field is ignored by the command but must not be empty.

The third column is the revocation date and time in UTC in the format YYMMDDHHMMSSZ and an optional
revocation reason that immediately follows it, separated by a comma. Valid reasons are "keyCompromise",
"CACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", and
"removeFromCRL", any other value or omitting a reason results in "unspecified".

The fourth column contains the certificate's serial number in hexadecimal encoding.

The fifth and sixth columns are both ignored by the command, so they may be omitted completely. They can
contain a path to the certificate (usually set to "unknown") and the certificate's subject DN with
slashes separating the RDNs.

Example index.txt:

V 310930122422Z 03 unknown /C=CH/O=strongSwan/CN=moon...
V 310930122422Z 04 unknown /C=CH/O=strongSwan/CN=sun...
R 310930122422Z 231002122422Z,keyCompromise 88
V Z 05

Note that the fields are separated by tabs. So if a certificate is valid, two tabs follow after the
expiration date. The third line in this example only specifies the relevant first four columns, the
fourth even uses a dummy expiration date.

EXAMPLES