Category Archives: OCSP

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

Posted on by

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.
With help of old article oscp-must-staple I managed to create CRA with extension.
Requested Extensions:
X509v3 Basi… Continue reading Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?→

Possible to create a self-signed certificate with AIA extension using PowerShell or openssl?

Posted on by

I am able to use the PowerShell New-SelfSignedCertificate cmdlet to create a self-signed cert just fine, but I’d like to create one with an AIA extension and give it an OCSP responder URL.
There is a cmdlet parameter called -Extension, but… Continue reading Possible to create a self-signed certificate with AIA extension using PowerShell or openssl?→

Possible to create a self-signed certificate with AIA extension using PowerShell or openssl?

Posted on by

I am able to use the PowerShell New-SelfSignedCertificate cmdlet to create a self-signed cert just fine, but I’d like to create one with an AIA extension and give it an OCSP responder URL.
There is a cmdlet parameter called -Extension, but… Continue reading Possible to create a self-signed certificate with AIA extension using PowerShell or openssl?→

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

Posted on by

I’m learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-valid-after date on a client cert?
Exa… Continue reading Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?→