OCSP Response Pre-Signer

CAs to Check

Select which CAs to produce OCSP Responses for. Responses will be generated for certificates issued by the selected CA.

CertId Hash Algorithm

Hash algorithm used for "issuerNameHash" and "issuerKeyHash" while producing responses. Some OCSP clients expect the same hash algorithm used in the request, to also be used in the response as well.

Generate Responses for All Certificates

Generates responses for all certificates issued by the selected CAs every time the service worker runs, regardless of when existing responses expires. Note that enabling this option overrides Update Expired Responses Only.

Select this setting when you want all OCSP responses to expire around the same time. Take into consideration how large the PKI is and the lifetime of the next update. Performance could be an issue if pre-signing for a large amount of certificates and Update Expired Responses Only should be used.

Update Expired Responses Only

Only update responses expiring before the configured time. Persisted OCSP Responses are considered expired when nextUpdate < configured time, see Time Before Response Expires.

Select this setting for updating responses as they expire, therefore responses do not all expire around the same time. Large PKIs using pre-signed OCSP should consider this option to optimize performance and not create a bottleneck for pre-signed OCSP responses.

Time Before Response Expires

The number of Days/Hours/Minutes/Seconds that should remain of the persisted response "validity" (nextUpdate) before a new response is generated.

Issue Final OCSP Response (eIDAS)

Generate and persist a final OCSP Response (nextUpdate '99991231235959Z') for each and every certificate issued by the CA when the CA is about to expire. See ETSI EN 319 411-2 (CSS-6.3.10-09).

Time Before CA Expires

The number of Days/Hours/Minutes/Seconds before the CA expires, to issue a final OCSP Response.