Whether APIGEE edge support OCSP validator?

[kalaivani]

Hi Team,

I am using APIGEE edge cloud and have enabled mTLS in Virtual host with  Client's root and Issuing Certificate added in Trust store.

Followed the below steps to test Client's certificate

    1. In APIGEE API request, added client certificate and connection is established with API proxy

    2. In case of Client certificate is not sent in the request , I am getting 400 Bad request with "No SSL certificate"

Currently I am able to access API proxies even though the Client certificate is revoked. To address this I  have added  "oCSPStapling": "on"  property in Virtual Host. But after adding this property also I am able to access APIGEE proxy API with revoked client certificate. 

Please let me know what is the fix for this issue.

[dchiesa1 · Accepted solution]

When you configure OCSP stapling on the Virtual Host, the Apigee will transmit the OCSP response to the client, to support the client's ability to evaluate whether the server's cert has been revoked. So that does not affect how Apigee treats the validation of the client certificate. 

To implement checking of revocation of client certs within Apigee, you will need to add some extra logic. It's not a simple "checkbox" configuration change. 

See here for a working example. 

[dchiesa1 · Accepted solution]

When you configure OCSP stapling on the Virtual Host, the Apigee will transmit the OCSP response to the client, to support the client's ability to evaluate whether the server's cert has been revoked. So that does not affect how Apigee treats the validation of the client certificate. 

To implement checking of revocation of client certs within Apigee, you will need to add some extra logic. It's not a simple "checkbox" configuration change. 

See here for a working example. 

[kalaivani]

As you suggested I have followed the java projects,shared flow and policies in the above link you have shared and it worked fine. Thanks for your support.

[API-Evangelist · Accepted solution]

Adding to dino's response.

Once you enable JC, make sure you have firewall's enabled to the CA's OCSP/CRL endpoint.