- Check Web Server Configuration:
If OCSP stapling is enabled on FortiWeb but not on the web server (e.g., Apache, Nginx), the server might not be providing the stapled OCSP response. Ensure that the web server is configured to support OCSP stapling.
- For Apache, verify the configuration by checking the ssl.conf file for SSLUseStapling and ensure it is set to on.
- For Nginx, confirm that the ssl_stapling directive is enabled in the server block configuration file.
- Use Diagnostic Commands:
Commands such as 'openssl s_client -connect testsites.com:443 -status' can be used to verify if the server is returning a stapled OCSP response.
This command checks whether the server is returning a stapled OCSP response. Look for the OCSP Response Status: successful in the output to confirm that the response is correctly returned. If not, further investigate the server configuration.
- Ensure Proper Communication between FortiWeb and OCSP Responder:
FortiWeb must be able to communicate with the OCSP responder (the CA's server issuing the certificates). Check for firewall rules or network issues that may prevent this communication, as it could cause OCSP stapling to fail.
- Check Network Issues:
Investigate any network problems, DNS resolution issues, or firewalls that may block communication between FortiWeb and the OCSP responder.
- DNS Resolution: Verify that FortiWeb is using a properly configured DNS server that can resolve the OCSP responder's hostname.
- Network Firewall: Check that no network firewalls between FortiWeb and the OCSP responder block the required traffic.
- Verify Certificate Authority (CA) Setup:
Confirm that the CA issuing the certificate supports OCSP and provides timely responses. OCSP stapling may fail if the CA’s responder is down or experiencing delays. Ensure the certificate is correctly configured with OCSP URLs in its AIA (Authority Information Access) field.
- Review FortiWeb Event Logs:
Analyze FortiWeb event logs to identify any issues related to OCSP.
Related document:
Configuring OCSP stapling
|
