Run the following openssl command to test the OCSP Responder service.

openssl ocsp -issuer <ca_cert> -serial <sn> -url <url> -VAfile <va_cert>

For example:

$ openssl ocsp -issuer issuer.pem -serial 0x000000002439fa8f5fe6370bb20ccb2556da6991 -url http://10.1.141.37/eva -VAfile ./VAFile.pem
Response verify OK
0x000000002439fa8f5fe6370bb20ccb2556da6991: good
This Update: Nov 7 18:52:34 2022 GMT
Next Update: Nov 8 02:41:13 2022 GMT

See below for a description of each command option.

The OCSP Responder service restarts when it loses its connection to the HSM. Run the evactl check all command to verify the HSM connection and other configuration settings.

-issuer <ca_cert>

Validate the status of a certificate issued by the <ca_cert> CA. Where <ca_cert> is the file path of the CA certificate. 

-serial <sn>

Validate the status of the certificate with the <sn> serial number.

-url <url>

Connect to the <url> Validation Authority service. Where <url> is an URL in the following format.

http://<host>/eva

Where <host> is the IP address or hostname of the host running Validation Authority.

-VAfile <va_cert>

Validate the response with the <va_cert> certificate. Where <va_cert> is the file path of the certificate: