Ubuntu Manpage: pki --ocsp - OCSP request parser and OCSP responder.

Provided by: strongswan-pki_5.9.13-2ubuntu4_amd64

NAME

       pki --ocsp - OCSP request parser and OCSP responder.

SYNOPSIS

       pki --ocsp [--in file] [--cacert file] [--debug level]

       pki --ocsp --respond [--in file] --cacert file --key file [--cert file] [--index file]
                  [--lifetime minutes] [--digest digest] [--rsa-padding padding] [--debug level]

       pki --ocsp --options file

       pki --ocsp -h | --help

DESCRIPTION

       This sub-command of pki(1) parses an Online Certificate Status Protocol (OCSP) request  as
       defined  by RFC 6960 and with the --respond option generates an OCSP response based on the
       OCSP request.  The certificate status for this may be provided by plugins so if not  using
       the  --index  option,  this  currently requires the openxpki and mysql plugins in order to
       directly access the internal certificate database of  an  OpenXPKI  (https://openxpki.org)
       server.

OPTIONS

-h, --help
Print usage information with a summary of the available options.

-v, --debug level
Set debug level, default: 1.

-+, --options file
Read command line options from file.

-i, --in file
OCSP request. If not given, the OCSP request is read from STDIN.

-C, --cacert file
CA certificate corresponding to one of the issuer hashes contained in the OCSP
request. If the OCSP request is signed, a CA certificate forming the trust chain.
Can be used multiple times.

-k, --key file
OCSP signer key. Can be used multiple times.

-c, --cert file
OCSP signer certificate (if it is not a CA certificate). Can be used multiple
times.

-x, --index file
OpenSSL-style index.txt providing information about the status of certificates
issued by the CA certificate loaded immediately before. Can be used multiple times
if the status for multiple CAs should be provided, just make sure to pass each
index.txt file right after the corresponding CA certificate.

See below for a description of the structure of these files.

-l, --lifetime minutes
Validity in minutes of the OCSP response (if missing, nextUpdate is omitted).

-g, --digest digest
Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or
sha512, sha3_224, sha3_256, sha3_384, sha3_512. The default is determined based on
the type and size of the OCSP signing key.

-R, --rsa-padding padding
Padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1.

INDEX.TXT DESCRIPTION

Each line in an index.txt file consists of six columns that are separated by tab
characters:

The first column denotes the certificate status, which can be either "V" (for valid), "E"
(for expired, treated like valid), or "R" (for revoked).

The second column contains the certificate's expiration date and time in UTC in the format
YYMMDDHHMMSSZ. This field is ignored by the command but must not be empty.

The third column is the revocation date and time in UTC in the format YYMMDDHHMMSSZ and an
optional revocation reason that immediately follows it, separated by a comma. Valid
reasons are "keyCompromise", "CACompromise", "affiliationChanged", "superseded",
"cessationOfOperation", "certificateHold", and "removeFromCRL", any other value or
omitting a reason results in "unspecified".

The fourth column contains the certificate's serial number in hexadecimal encoding.

The fifth and sixth columns are both ignored by the command, so they may be omitted
completely. They can contain a path to the certificate (usually set to "unknown") and the
certificate's subject DN with slashes separating the RDNs.

Example index.txt:

V 310930122422Z 03 unknown /C=CH/O=strongSwan/CN=moon...
V 310930122422Z 04 unknown /C=CH/O=strongSwan/CN=sun...
R 310930122422Z 231002122422Z,keyCompromise 88
V Z 05

Note that the fields are separated by tabs. So if a certificate is valid, two tabs follow
after the expiration date. The third line in this example only specifies the relevant
first four columns, the fourth even uses a dummy expiration date.

EXAMPLES