Enabling Nonce

For added security (to avoid replay attacks), an OCSP requester can add a nonce to the certificate validation request. A nonce is a random number, attached to each request, that alters the encryption. When the nonce feature is enabled, the OCSP responder computes an appropriate response using the nonce value.

Note Using a nonce puts more load on the OCSP responder because it cannot precalculate or cache responses. Some OCSP responders may not accept requests with a nonce.

Note The nonce feature is disabled by default.

To enable the OCSP nonce feature, follow these steps:

  1. Edit the following file:

    Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

    Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

  2. Within the <ocsp> section of the file (find the <ocsp> tag), search for the line that begins with the following text:

    <nonce>
  3. Do one of the following:

    • To enable the nonce feature, change the line to read as follows:

      <nonce>true</nonce>
    • To disable the nonce feature (and use a general request), change the line to read as follows:

      <nonce>false</nonce>
  4. Save the nms-auth-config.xml file.
  5. Run the following command for the change to take effect:

    nnmsecurity.ovpl -reloadAuthConfig