Check certificate for revocation
For all the cloud providers, NetBackup provides the capability to verify the revocation status of SSL certificates using the Online Certificate Status Protocol (OCSP). If SSL and the option are both enabled, NetBackup verifies each SSL certificate. To verify, NetBackup makes an OCSP request to the CA to check the revocation status of the certificate presented during the SSL handshake. NetBackup does not connect to the cloud provider, if the status is returned as revoked or it fails to connect to the OCSP endpoint present in the SSL certificate.
To enable validation, update the USE_CRL property from the Cloud object store account dialog.
OCSP endpoints are HTTP thus, turn off any firewall rule that blocks HTTP (port 80) connections to external networks. For example, http://ocsp.sca1b.amazontrust.com
OCSP URL is dynamically retrieved from the certificate; thus, disable any firewall rule that blocks unknown URLs.
Typically, the OCSP URL's endpoint supports IPV4. For IPV6 environments, disable the Check certificate revocation option.
Private Clouds typically have a self-signed certificate. Thus, for private clouds, Check certificate revocation is not required. Disable this check while configuring the account; otherwise, account creation fails.
The OSCP URL of the CA should be present in the certificate's Authority Information Access extension.