Setting up a Responder Using the CLI

In this example, there is a CA that can be offline and an OCSP responder will be set up using the CLI that answers for this CA.

A basic EJBCA instance that you can use CLI commands on (no CA needed) should be installed prior to performing the following steps.

The order of events are as the workflow above, with an extra step of importing the CA certificate:

1. Import the CA certificate (of OCSP_CA) as an External CA in the OCSP responder.

2. Create a Crypto Token and generate the OCSP responders signing key.

3. Create an OCSP Key Binding, which is the configuration of the OCSP responder answering queries.

4. Generate a CSR for the OCSP Key Binding, sending the CSR to the External CA and getting a signed OCSP signer certificate back.

5. Import the OCSP signer certificate and activate the OCSP Key Binding.

Use the following commands and note that the External CA is called OCSP_CA and has DN 'CN=OCSP_CA'.

Test the responder by querying for status of the OCSP signer certificate itself:

Get a certificate, received on file (qwe.pem), issued by the OCSP_CA. We can feed certificates, as an allow list, to the responder in many different ways (it's a normal database). But before we import it to the OCSP responder, we can check status, which should be unknown (with the current configuration) when it is not present in the OCSP database.