OCSP Unreachable - OCSP 响应服务不可达 —— 无法获取吊销状态，存在已吊销证书误通过的风险

Zurückkehren Übergeordnet: Certificate Alarm - 证书告警子树 —— 到期预警 10-19、已过期 20-29、吊销校验异常 30-59、CA 与信任链异常 60-99 (1.3.6.1.4.1.59719.0.3)

Technische Informationen

Punkt-Notation:	`1.3.6.1.4.1.59719.0.3.40`
ASN.1-Notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) notifications(0) certificate-alarm(3) ocsp-unreachable(40) }`
OID-IRI-Notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/Notifications/CertificateAlarm/OcspUnreachable`
WEID-Notation:	`weid:P-1A2V-0-3-14-4`
DER-Kodierung:	`06:0B:2B:06:01:04:01:83:D2:47:00:03:28`

Beschreibung

English:
The Online Certificate Status Protocol (OCSP) responder does not respond. The system failed to obtain the certificate revocation status from the OCSP responder; revocation verification cannot proceed and revoked certificates may wrongly pass authentication.
Recommended severity: major. Recommended handling: verify the OCSP responder address, network connectivity, firewall and access control policies; confirm that the OCSP service is running; check the system time and logs, then retry or switch to a standby responder after troubleshooting.
Status: registered but unused. Not yet emitted by any monitoring component; when implemented, carry the responder address, the timeout value and the consecutive failure count. The unused state shall be re-verified at each revision of this file.
Recommendation: configure at least one standby responder and a CRL fallback path (1.3.6.1.4.1.59719.0.3.30); when both OCSP and CRL are unavailable, follow the documented revocation checking degradation policy.
See also: 1.3.6.1.4.1.59719.6.1.6, 1.3.6.1.4.1.59719.5.1.600, 1.3.6.1.4.1.59719.5.600.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
在线证书状态协议（Online Certificate Status Protocol，OCSP）响应服务无响应。系统无法从 OCSP 响应服务获取证书吊销状态，吊销校验无法执行，存在已吊销证书通过认证的风险。
建议级别：重要。处理建议：核对 OCSP 响应地址、网络连通性、防火墙与访问策略；确认 OCSP 服务正常运行；核查系统时间与日志，修复后重试或切换备用响应节点。
状态：已注册但未使用。尚无监控组件上报该告警；实现时应携带响应地址、超时值与连续失败次数。本文件每次修订时须重新核验该未使用状态。
建议：至少配置一个备用响应节点与 CRL 兜底路径（1.3.6.1.4.1.59719.0.3.30）；当 OCSP 与 CRL 同时不可用时，按已记录的吊销校验降级策略执行。
关联节点：1.3.6.1.4.1.59719.6.1.6、1.3.6.1.4.1.59719.5.1.600、1.3.6.1.4.1.59719.5.600。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registrierungsstelle

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

Die Registrierungsstelle möchte ihre persönlichen Informationen nicht veröffentlichen.

Untergeordnete Objekte

ID	Base36	ASN.1 IDs (kommagetrennt)	IRI IDs (Kommagetrennt)	RA	Kommentar	Erstellt	Geändert
Keine Einträge vorhanden

Alternative Bezeichner

Bezeichner	Beschreibung
aid:D276000186B200054278A5EC4EBAEA2D (Keine PIX erlaubt)	OIDplus Information Object Anwendungsbezeichner (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-21ba8d053a01	OIDplus Information Object Custom UUID (RFC 9562)
guid:6f84108a-f5fd-3eae-a699-2087c315aeeb	Namensbasierte Version 3 / MD5 UUID mit Namensraum UUID_NAMEBASED_NS_OID
guid:2e3a9fce-01e4-5fe5-8378-2984c6aa386f	Namensbasierte Version 5 / SHA1 UUID mit Namensraum UUID_NAMEBASED_NS_OID
mac:A2-9B-CE-BA-EA-2D	OIDplus Information Objekt Unicast MAC-Adresse (AAI)
mac:A3-9B-CE-BA-EA-2D	OIDplus Information Objekt Multicast MAC-Adresse (AAI)
weid:P-1A2V-0-3-14-4	WEID-Notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=1320872493	OIDplus Information Object X.500 DN