Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure NNMi to Support Public Key Infrastructure User Authentication > Certificate Validation (CRL and OCSP) > Validating Certificates Using Online Certificate Status Protocol (OCSP)

Validating Certificates Using Online Certificate Status Protocol (OCSP)

NNMi supports Online Certificate Status Protocol (OCSP) to check for revoked certificates interactively.

PKI user authentication uses OCSP to verify the revocation status of a certificate by querying an OCSP responder. An OCSP responder provides immediate and accurate revocation information on specific certificates as follows:

An OCSP client submits a certificate status request to an OCSP responder.
The OCSP client suspends acceptance of the certificate in question until the OCSP responder provides a digitally signed response.
The OCSP responder indicates the status of the certificate by returning one of the following values:
- Good (pass; user is granted access)
- Revoked (fail; user is denied access)
- Unknown (fail; user is denied access)

Because the OCSP responder is queried for every certificate, whereas the CRL is downloaded periodically (for example, once per day), OCSP responses might be more up-to-date than corresponding CRLs.

Note NNMi stores the OCSP configuration in the following location:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml
Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

A default version of the configuration file can be used for reference purposes to view new available options. The default configuration file is stored in the following location:

Windows: %NnmInstallDir%\newconfig\HPOvNnmAS\nmsas\conf\nms-auth-config.xml
Linux: $NnmInstallDir/newconfig/HPOvNnmAS/nmsas/conf/nms-auth-config.xml

Enabling and Disabling OCSP Checking

To configure OCSP checking, follow these steps:

Edit the following file:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml
Within the <ocsp> section of the file (find the <ocsp> tag), search for the line that begins with the following text:
```
<enabled>
```
Do one of the following:
- To enable OCSP checking, change the line to read as follows:
```
<enabled>true</enabled>
```
- To disable OCSP checking, change the line to read as follows:
```
<enabled>false</enabled>
```
Save the nms-auth-config.xml file.
Run the following command for the change to take effect:
```
nnmsecurity.ovpl -reloadAuthConfig
```

Changing the OCSP Enforcement Mode

By default, NNMi is set to enforce OCSP.

To change the product’s enforcement of OCSP, follow these steps:

Edit the following file:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml
Within the <ocsp> section of the file (find the <ocsp> tag), search for the line that begins with the following text:
```
<mode>
```
Change the line to read as one of the following:
```
<mode><value></mode>
```
where <value> is one of the following:
- ENFORCE: Enforce OCSP where specified in the certificates
- ATTEMPT: Check OCSP but allow access if OCSP is not available
- REQUIRE: Require and enforce OCSP in certificates
Save the nms-auth-config.xml file.
Run the following command for the change to take effect:
```
nnmsecurity.ovpl -reloadAuthConfig
```

Enabling Nonce

For added security (to avoid replay attacks), an OCSP requester can add a nonce to the certificate validation request. A nonce is a random number, attached to each request, that alters the encryption. When the nonce feature is enabled, the OCSP responder computes an appropriate response using the nonce value.

Note Using a nonce puts more load on the OCSP responder because it cannot precalculate or cache responses. Some OCSP responders may not accept requests with a nonce.

Note The nonce feature is disabled by default.

To enable the OCSP nonce feature, follow these steps:

Edit the following file:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml
Within the <ocsp> section of the file (find the <ocsp> tag), search for the line that begins with the following text:
```
<nonce>
```
Do one of the following:
- To enable the nonce feature, change the line to read as follows:
```
<nonce>true</nonce>
```
- To disable the nonce feature (and use a general request), change the line to read as follows:
```
<nonce>false</nonce>
```
Save the nms-auth-config.xml file.
Run the following command for the change to take effect:
```
nnmsecurity.ovpl -reloadAuthConfig
```

Specifying the URL of the OCSP Responder

Optionally, you can specify the URL of the OCSP responder as follows:

Edit the following file:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml
Within the <ocsp> section of the file (find the <ocsp> tag), search for the line that begins with the following text:
```
<responder>
```
Edit the line to read as follows:
```
<responder><URL></responder>
```
where <URL> is the URL associated with the OCSP responder.
Save the nms-auth-config.xml file.
Run the following command for the change to take effect:
```
nnmsecurity.ovpl -reloadAuthConfig
```

Note The OCSP URL must use the HTTP protocol.

If there is no OCSP URL specified in the nms-auth-config.xml file, NNMi attempts to obtain an OCSP responder from the certificate itself.
If there is no OCSP responder specified in the certificate, NNMi uses the <mode> setting to determine what action to take:
- If the mode is ENFORCE or ATTEMPT, NNMi passes the OCSP validation step for this certificate.
- If the mode is REQUIRE, NNMi rejects the certificate.

Send Help Center feedback