OCSP App-ID fail

L1 Bithead

OCSP App-ID fail


is anyone using ocsp as single app in a rule ? It's sometimes failing to match, seen as "web-browsing" although on very easy to recognize URLs such as ocsp.comodoca.com. Quite annoying when you debug a third-party software failing to setup because of this but only mentionning "cert chain failed".

App version 752-4343 on v8.0.5.

thanks !


L7 Applicator

Re: OCSP App-ID fail

The domain name itself is not used for App-ID, as the domain doesn't necessarily dictate what is there. There could easily be non-OCSP content there despite the hostname.


That said, if you have (or can get) a packet capture of the issue happening, open up a support ticket so it can be given to the appropriate folks who handle the App-ID information. I've never seen that issue, but admittadly I am not blocking web-browsing so either way it would work in my environment.

Like what you see?

Show your appreciation!





The Live Community thanks you for your participation!