Enabling OCSP checking in Java in AMS

To enable OCSP checking for Java in Advanced Message Security, modify the java.security file or the keystore configuration file.

About this task

There are two ways of enabling OCSP checking in Advanced Message Security:

Check whether your certificate contains an Authority Information Access (AIA) certificate extension.

If AIA is not set up or you want to override your certificate, edit the $JAVA_HOME/lib/security/java.security file with the following properties:
```
ocsp.responderURL=http://url.to.responder:port
ocsp.responderCertSubjectName=CN=Example CA,O=IBM,C=US
```
and enable OCSP checking by editing the $JAVA_HOME/lib/security/java.security file with the following line:
```
ocsp.enable=true
```
If AIA is set up, enable OCSP checking by editing the $JAVA_HOME/lib/security/java.security file with the following line:
```
ocsp.enable=true
```

If you are using Java Security Manager, too complete the configuration, add the following Java permission to lib/security/java.policy

permission java.security.SecurityPermission "getProperty.ocsp.enable";

Add the following attribute to the configuration file:

ocsp.enable=true

Important: Setting this attribute in the configuration file overrides java.security settings.

To complete the configuration, add the following Java permissions to lib/security/java.policy:

permission java.security.SecurityPermission "getProperty.ocsp.enable";
permission java.security.SecurityPermission "setProperty.ocsp.enable";