Troubleshooting Tip: OCSP stapling is not working

[Ahmed_Galal]

Description	This article describes how to troubleshoot OCSP Stapling in FortiWeb.
Scope	FortiWeb.
Solution	Make sure to select the right local certificate and CA certificate of OCSP server/responder at Server Objects -> Certificates -> OCSP Stapling:   The OCSP URL must contain either [http:// OR https://] at Server Objects -> Certificates -> OCSP Stapling: Use the openssl command to verify if the OCSP server working properly: openssl ocsp -noverify -no_nonce -issuer cacert.pem -cert client03.pem -text -url  http://127.0.0.1:8080/opt/tanlca Note 1: cacert.pem is the ocsp CA certificate. Note 2: client03.pem is the test certificate. to check if it has been revoked. Note 3: The above sample uses 3 parameters that match FortiWeb configuration, and FortiWeb actually uses this command on the backend to call openssl to verify/test OCSP stapling, then return the result to the frontend. Related articles: https://help.fortinet.com/fweb/590/Content/FortiWeb/fortiweb-admin/ocsp_stapling.htm OCSP-Based certificate revocation check