ocsp.enable Java Security Property

Default Value

false

This property's value is either true or false. If true, OCSP checking is enabled when doing certificate revocation checking; if false or not set, OCSP checking is disabled.
via: Java PKI API Programmer's Guide

ocsp.enable Explained

OCSP allows a client to ask a certificate authority's OCSP responder whether a specific certificate has been revoked, instead of downloading an entire certificate revocation list (CRL). Client side OCSP support was added in JDK 5.0.

The ocsp.enable property has no effect unless revocation checking is enabled. For TLS connections that use the default trust manager, revocation checking is disabled by default and must be turned on with the com.sun.net.ssl.checkRevocation system property. When using the CertPathValidator API directly, revocation checking is controlled by PKIXParameters.setRevocationEnabled(). Per Oracle's documentation on client-driven OCSP:

Both steps are necessary. The ocsp.enable setting has no effect unless revocation checking is enabled.

OCSP and CRL Fallback

When revocation checking is enabled and no PKIXRevocationChecker has been supplied programmatically, the JDK's PKIX implementation behaves as follows:

• ocsp.enable=true - OCSP is checked first. If the OCSP check fails for a reason other than the certificate being revoked (for example the responder is unreachable), it falls back to checking CRLs.
• ocsp.enable=false or not set - only CRLs are checked. To download CRLs from the locations listed in the certificate, the com.sun.security.enableCRLDP system property must also be set to true.

If the revocation status cannot be determined by any method, certificate validation fails.

Setting ocsp.enable

Because ocsp.enable is a security property and not a system property, it cannot be set with a -D command line argument. Instead you can:

• Add ocsp.enable=true to the java.security file (located in conf/security/java.security in Java 9+, or jre/lib/security/java.security in Java 8).
• Add it to a separate properties file and point to it with the java.security.properties system property.
• Set it in code: java.security.Security.setProperty("ocsp.enable", "true");

Example

Enable OCSP revocation checking (with CRL fallback) for TLS connections:

ocsp.enable=true

Save the above in a file named revocation.security, and then start java with:

java -Djava.security.properties=/path/to/revocation.security -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true -jar app.jar

Note that com.sun.net.ssl.checkRevocation and com.sun.security.enableCRLDP are system properties, so they are passed with -D rather than placed in the security properties file.

Related Properties

• com.sun.net.ssl.checkRevocation - system property that enables revocation checking for TLS connections.
• com.sun.security.enableCRLDP - system property that enables downloading CRLs from a certificate's CRL Distribution Points extension.
• ocsp.responderURL - security property that overrides the location of the OCSP responder. By default the location is determined from the Authority Information Access extension of the certificate being validated.
• ocsp.responderCertSubjectName, ocsp.responderCertIssuerName, ocsp.responderCertSerialNumber - security properties that identify the OCSP responder's certificate, when it is not the issuer of the certificate being validated.
• jdk.tls.client.enableStatusRequestExtension - system property that enables OCSP stapling on the client side.

Here are some other Java properties related to networking:

• com.sun.net.ssl.checkRevocation
• com.sun.security.enableCRLDP
• http.agent
• http.keepAlive
• http.maxConnections
• http.nonProxyHosts
• http.proxyHost
• http.proxyPort
• https.protocols
• https.proxyHost
• https.proxyPort
• java.net.preferIPv4Stack
• java.net.preferIPv6Addresses
• java.net.useSystemProxies
• javax.net.debug
• javax.net.ssl.trustStore
• jdk.http.maxHeaderSize
• jdk.net.hosts.file
• jdk.tls.client.protocols
• jdk.tls.server.newSessionTicketCount
• jdk.crypto.disabledAlgorithms
• jdk.tls.disabledAlgorithms
• networkaddress.cache.negative.ttl
• networkaddress.cache.ttl
• sun.net.client.defaultConnectTimeout
• sun.net.client.defaultReadTimeout
• sun.net.inetaddr.ttl

References

• Java PKI API Programmer's Guide - Appendix C: OCSP Support
• Client-Driven OCSP and OCSP Stapling
• RevocationChecker.java - OpenJDK Source

Supported Since

Java has supported the ocsp.enable security property since Java 5.

Setting / Reading ocsp.enable at Runtime

You can set ocsp.enable at runtime with the following Java code:

java.security.Security.setProperty("ocsp.enable", "true");

Please note that the ocsp.enable value needs to be specified early, before the internal java classes are loaded that might use this value otherwise it will be ignored.

To read the value of ocsp.enable at runtime, you can use this Java code:

String propertyValue = java.security.Security.getProperty("ocsp.enable");
if (propertyValue != null) {
    System.out.println("ocsp.enable = " + propertyValue);
} else {
    System.out.println("ocsp.enable was null");
}

Setting ocsp.enable on Startup

Be aware that ocsp.enable is not a Java System Property, it is a Java Security Property. Therefore you cannot set it from the command line using -Docsp.enable. You have to set ocsp.enable in the java.security properties file.