EJBCA签出的证书增加OCSP

默认EJBCA签出的证书是没有带上OCSP，在官网文档中可以注意到：

Default CA Defined Validation Data
The values of the semi-colon separated list for the ‘CA issuer’ and ‘OCSP Service Locator’ (only one URL possible) are used for the certificates Authority Information Access extension as specified in RFC5280 (section 4.2.2.1). Certificate profiles used to issue end entity certificates with that CA must have the Authority Information Access, Use CA defined CA issuer, and/or Use CA defined OCSP locator options enabled.

因此除了在Certification Authorities中正确配置CRL和OCSP外：

EJBCA中Certificate Authority配置CRL和OCSP地址

还需要在Certificate Profiles中配置Authority Information Access、Use CA defined CA issuer、Use CA defined OCSP locator：

EJBCA中Certificate Profile配置CRL和OCSP

这样签出的证书就带有OCSP信息了：

EJBCA签出的带有OCSP的证书

如果要带上CRL信息，那么需要在Certificate Profiles中配置Use CRL Distribution Points和Use CA defined CRL Distribution Point：

EJBCA中Certificate Profile配置CRL和OCSP

这样签出的证书就带有CRL信息了：

EJBCA签出的带有CRL的证书

参考文档：
1、https://download.primekey.com/docs/EJBCA-Enterprise/6_13_0/CA_Fields.html

转载时请保留出处，违法转载追究到底：进城务工人员小梅 » EJBCA签出的证书增加OCSP