Enabling or disabling the OCSP override responder using the CLI

Use the CLI commands in this section to enable or disable the OCSP override responder so that the default OCSP responder is used when the certificate is being validated even if the certificate references an OCSP responder.

Note

The OCSP override responder setting is disabled by default.

To enable the OCSP override responder:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Enable the override of the OCSP responder from the certificate that is being validated and instead use the default OCSP responder.
```
hostname (config) # aaa authentication certificate ocsp override-responder
```

Verify the status of the OCSP responder.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : required

  Certificate field for username : x509-cert-subject-cn

  CA certificate bundle          : client-cert-auth

  OCSP enabled                   : no

  Default OCSP URL               : http://10.3.13.219:80

 OCSP override responder        : yes

...

Save your changes.
```
hostname (config) # write memory
```

To disable the OCSP override responder:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Disable the override of the OCSP responder from the certificate that is being validated.
```
hostname (config) # no aaa authentication certificate ocsp override-responder
```

Verify the status of the OCSP responder.

hostname (config) # show aaa authentication certificate

Certificate based authentication settings:

  Web Policy                     : required

  Certificate field for username : x509-cert-subject-cn

  CA certificate bundle          : client-cert-auth

  OCSP enabled                   : no

  Default OCSP URL               : http://10.3.13.219:80

 OCSP override responder        : no

...