This article describes the best practices for configuring an OCSP server using the 'set ocsp-default-server' command under 'config vpn certificate setting'. The following sections explain the operational impact of this setting on both internal and public-facing traffic. Â What the ocsp-default-server option does:
In a standard certificate validation process, the FortiGate retrieves the OCSP responder URL from the Authority Information Access (AIA) field within the certificate being inspected. When ocsp-default-server is configured, the FortiGate is instructed to ignore the URL in the certificate and instead send the revocation request to a manually defined server.  How to configure the ocsp-default-server: First, create an ocsp-server using the config vpn certificate ocsp-server command. After, specify the oscp-server name with the command 'set ocsp-default-server' under 'config vpn certificate setting'.  When to configure the ocsp-default-server option:
This setting is designed for specific, controlled environments. Configuration is appropriate in the following instances: Air-Gapped/Restricted Networks: The FortiGate lacks internet access to reach public OCSP responders (such as DigiCert or Let's Encrypt). In this case, a central internal OCSP proxy or responder is used to verify internal certificates. Centralized PKI Management: An organization utilizes a private Certificate Authority (CA) and requires all revocation checks to be forced through a specific internal security appliance for auditing or performance reasons. AIA Extension is Missing: Internal certificates lack the AIA extension, making it impossible for the FortiGate to find the responder automatically.
When to avoid using ocsp-default-server:
This setting should be avoided - or left unset - in the following scenarios: General Internet Browsing with Deep Inspection enabled: If the FortiGate performs Deep SSL Inspection on traffic heading to the public internet, a default OCSP server should not be used. An internal OCSP server cannot validate the status of public certificates (e.g., Google, Microsoft, and other public websites), so it returns an 'Unknown' or 'Error' response. Because the FortiGate cannot verify certificate validity, the connection is blocked to ensure security, resulting in widespread 'Certificate Validation Failed' errors. Multi-Vendor Environments: If validating certificates are issued by multiple different third-party CAs, a single default server is unlikely to contain revocation data for all issuers. High-Latency Internal Links: If the default OCSP server is located across a slow WAN link, latency is introduced into every new SSL handshake across the entire firewall, as every connection must wait for an OCSP response before proceeding.
 Recommendation and remediation:
For the majority of deployments involving web filtering and SSL inspection, the default behavior (using the AIA field) is the correct configuration.
To determine if a global override is active, check the settings:
 show vpn certificate setting
 To allow the FortiGate to dynamically choose the correct OCSP responder based on the certificate being inspected, set up the following:  config vpn certificate setting
  unset ocsp-default-server
end
Note: When switching back to the OCSP responder URL provided in the certificate, also verify that ocsp-option is set to certificate under config vpn certificate setting. The server option selects a configured OCSP server instead of the URL in the certificate.
| 
