Implementation of Online Certificate Standard Protocol (OCSP) in addition to Certificate Revocation List (CRL).
Summary
This Change seeks to make improvements to the Microsoft Azure Application Gateway module. A defect has been identified which requires the implementation of a manual/ customer workaround when checking the Certificate Revocation Lists (CRLs) systems within the Central Switching Service (CSS) to ensure certificates are revoked. This change seeks to remove the need to complete a manual workaround and implement a real-time certification validation capability.
Latest update and next planned activity
Date of latest update
Latest Update
14/05/2024 - At the request of the proposer, this Change Proposal has now been withdrawn. The rationale for withdrawing the proposal was that the benefits afforded by this change will not be fully realised until 2026 (renew of digital certificates), and the risk profile around revoked certificates remains unchanged during this period. DCC recommend this change is revisited in 12 months, to allow sufficient time for review and resubmission ahead of any certificate renewal activities.
Impacts Overview
Impacted REC Parties and Market Participants
Other
Impacted REC Documents
Schedule 25 - Central Switching Service
Impacted REC Services
Central Switching Service (CSS)
Priority and rationale
Standard
Priority last updated on 29 May 2026
Solution development
Problem Statement
There is currently a Microsoft Azure Application Gateway module defect against the checking of Certificate Revocation Lists (CRLs), with Microsoft stating that the CRL related defect will not be fixed. Consequently, any system within the CSS ecosystem, systems that use Switching Key Infrastructure (SWIKI), that have incorporated the Azure Application Gateway module to manage the TLS connection will have been required to implement a manual/custom workaround to ensure that certificates that are revoked are not allowed to establish a connection.
Proposed solution summary
- The proposed solution is to roll out support for Online Certificate Standard Protocol (OCSP) in addition to Certificate Revocation List (CRL). The scope of the change will be: - Implementation of a central OCSP server and the update of the associated PKI processes to manage the Certificate Revocation. This will cover the TLS and JWS Certificate Revocation. - CSS implementation of Application Gateway will be reconfigured to include the OCSP functionality and server. - CSS change to implement the OCSP checking for the JWS certificates. - All new certificates that are issued will include the detail of the OCSP Server, as part of the migration approach all new certificates will have this information embedded. - All parties connecting to CSS have the relevant information for them to exploit the advanced features that OCSP introduces. The CRL checking functionality will be maintained so this change is an optional upgrade for any Systems that operate using Switching Key Infrastructure.
No documents available.
Change Plan
Solution Analysis and Development
Completed
Start:
30 Oct 2023Due:
26 Jan 2024Completion:
26 Jan 2024Original submission
Change details
Stuart Pitcher - Smart DCC
30 Oct 2023
Change details
Implementation of Online Certificate Standard Protocol (OCSP) in addition to Certificate Revocation List (CRL).
There is currently a Microsoft Azure Application Gateway module defect against the checking of CRLs. Microsoft has stated that the CRL related defect will not be fixed but the support within the Application Gateway module for OCSP will be rolled out (this is available now in the latest Application Gateway) version.
Any system within the Central Switching Service (CSS) ecosystem (systems that use SWitching Key Infrastructure (SWKI)) that incorporated the Azure Application Gateway module to manage the TLS connections would have required to implement a manual/custom workaround to ensure that certificates that are revoked (added on the SWKI CRL) are not allowed to establish a connection.
The core delivery required for this Change is the:
• Implementation of a central OCSP server and the update of the associated PKI processes to manage the Certificate Revocation. This will cover the TLS and JWS Certificate Revocation.
• CSS implementation of Application Gateway will be reconfigured to include the OCSP functionality and server.
• CSS change to implement the OCSP checking for the JWS certificates
• All new certificates that are issued will include the detail of the OCSP Server, as part of the migration approach all new certificates will have this information embedded.
• All parties connecting to CSS have the relevant information for them to exploit the advanced features that OCSP introduces.
Documentation changes:
• CSS Security and API Supporting Information V1.0 – Updated to include OCSP Background Information
• Central Switching Service Schedule V1.1 – Paragraph 4.4 to include reference to OCSP; Paragraph 8.4 to reference OCSP.
Note: Access and maintenance of the current CRLs (all environments) will be continued so there is no impact to CSS Users service.
• Implementation of a central OCSP server and the update of the associated PKI processes to manage the Certificate Revocation. This will cover the TLS and JWS Certificate Revocation.
• CSS implementation of Application Gateway will be reconfigured to include the OCSP functionality and server.
• CSS change to implement the OCSP checking for the JWS certificates
• All new certificates that are issued will include the detail of the OCSP Server, as part of the migration approach all new certificates will have this information embedded.
• All parties connecting to CSS have the relevant information for them to exploit the advanced features that OCSP introduces.
Documentation changes:
• CSS Security and API Supporting Information V1.0 – Updated to include OCSP Background Information
• Central Switching Service Schedule V1.1 – Paragraph 4.4 to include reference to OCSP; Paragraph 8.4 to reference OCSP.
Note: Access and maintenance of the current CRLs (all environments) will be continued so there is no impact to CSS Users service.
A Certificate Revocation List is list of revoked certificates that is issued and maintained by the Certificate Authority. CRLs are made publicly available by the Certificate Authority and the URL for the relevant CRL is contained within the certificate metadata. When a TLS connection is established to CSS by a connecting system, the CRL will be downloaded and if the connecting TLS certificates are not on the CRL then the certificate is deemed valid. Note that some systems may not download the CRL for every connection made and store the CRL as a cached version and periodically update the cached version. In such situations there is a risk that the cached version of the CRL will not contain the most up to date information until the next cache CRL refresh.
Online Certificate Status Protocol is a technique where the OCSP server, upon interrogation by the systems attempting the TLS connection (TLS handshake), will respond with the status of the certificate. The status response will be one of :
Good
A certificate status of “good” shows that the certificate is valid for use. At a minimum, this shows that a certificate with the corresponding serial number and validity period hasn’t been revoked.
Revoked
The “revoked” state indicates that the certificate has been revoked, either temporarily or permanently. If the CA has no record of ever having issued a certificate with the certificate serial number in the request, then this status may also be returned.
Unknown
The “unknown” state indicates that the responder doesn’t know about the certificate being requested, usually because the request indicates an unrecognised issuer that is not served by this responder.
Note: Once implemented, OCSP will be available to check the status of the TLS and JWS certificates that form the SWIKI certificate estate.
Online Certificate Status Protocol is a technique where the OCSP server, upon interrogation by the systems attempting the TLS connection (TLS handshake), will respond with the status of the certificate. The status response will be one of :
Good
A certificate status of “good” shows that the certificate is valid for use. At a minimum, this shows that a certificate with the corresponding serial number and validity period hasn’t been revoked.
Revoked
The “revoked” state indicates that the certificate has been revoked, either temporarily or permanently. If the CA has no record of ever having issued a certificate with the certificate serial number in the request, then this status may also be returned.
Unknown
The “unknown” state indicates that the responder doesn’t know about the certificate being requested, usually because the request indicates an unrecognised issuer that is not served by this responder.
Note: Once implemented, OCSP will be available to check the status of the TLS and JWS certificates that form the SWIKI certificate estate.
Impacts
Other (please specify in the Additional information box below)
Other (please provide details in Additional information box below)
This change has no direct impact to Energy Consumers, but is an update to the Certificate Revocation solution.
This change will allow the removal of any workarounds that have been introduced to mitigate the Microsoft Azure Application Gateway defect. This change will also introduce the advanced features that OCSP brings over CRL into SWKI.
The OCSP functionality will be implemented for the whole SWIKI certificate estate meaning that the JWS Message Signing Certificates status can be queried with the OCSP server.
This change will allow the removal of any workarounds that have been introduced to mitigate the Microsoft Azure Application Gateway defect. This change will also introduce the advanced features that OCSP brings over CRL into SWKI.
The OCSP functionality will be implemented for the whole SWIKI certificate estate meaning that the JWS Message Signing Certificates status can be queried with the OCSP server.
Schedule 25 - Central Switching Service
Central Switching Service Schedule V1.1 – Paragraph 4.4 to include reference to OCSP; Paragraph 8.4 to reference OCSP.
No details provided
-
No details provided
-
No details provided
-
No details provided
-
Central Switching Service (CSS), CSS Certificate Authority
The core delivery of this change requires the following updates to CSS and Certificate Authority Processes:
• Implementation of a central OCSP server and the update of the associated PKI processes to manage the Certificate Revocation. This will cover the TLS and JWS Certificate Revocation.
• CSS implementation of Application Gateway will be reconfigured to include the OCSP functionality and server.
• CSS change to implement the OCSP checking for the JWS certificates
• All new certificates that are issued will include the detail of the OCSP Server, as part of the migration approach all new certificates will have this information embedded.
• All parties connecting to CSS have the relevant information for them to exploit the advanced features that OCSP introduces.
An update to the following Category 3 document :
• CSS Security and API Supporting Information V1.0 – Updated to include OCSP Background Information
• Implementation of a central OCSP server and the update of the associated PKI processes to manage the Certificate Revocation. This will cover the TLS and JWS Certificate Revocation.
• CSS implementation of Application Gateway will be reconfigured to include the OCSP functionality and server.
• CSS change to implement the OCSP checking for the JWS certificates
• All new certificates that are issued will include the detail of the OCSP Server, as part of the migration approach all new certificates will have this information embedded.
• All parties connecting to CSS have the relevant information for them to exploit the advanced features that OCSP introduces.
An update to the following Category 3 document :
• CSS Security and API Supporting Information V1.0 – Updated to include OCSP Background Information
No details provided
Any party connecting to CSS will be able to take advantage of the improved functionality that is delivered as part of the OCSP upgrade.
The CRLs will continue to be maintained so there will be no impact to current functionality if no upgrade is made by a CSS connecting party.
The CRLs will continue to be maintained so there will be no impact to current functionality if no upgrade is made by a CSS connecting party.
No details provided
-
No
No details provided
Priority & timing
No
-
No
No
No details provided
-
Activity
james.hardy has been allocated as Lead Analyst.
caroline.milner has been allocated as SME.