Although this bug probably has a workaround of manually connecting the OCSP instance to the desired CA, I believe that this bug is a potential regression.

Proposed Milestone: 10.3.3

Per discussions in CS/DS meeting of 06/06/2016, either fix this issue or clearly document the workaround: 10.3.3

I tried to reproduce this issue.

What I found was that the OCSP configuration is performed correctly. That is, the CA is configured in the remote OCSP, and shows up in the UI pages on the OCSP. The publisher is also set up in the CA CS.cfg.

The OCSP does not receive the first CRL update until the MasterCRL is published though. Trying to publish manually through the CA UI does not trigger publishing. Once publishing occurs though, it publishes to the OCSP correctly, meaning that all the setup is correct.

So, the problem is just getting publishing to happen faster. If you wait long enough, it will happen by itself.

Certainly, one way to do this is to set :

ca.crl.MasterCRL.publishOnStart=true on the CA and then restarting the CA.

I think this is a documentation issue.

One thing I noticed was that once the initial update was done, changes were published a lot faster afterwards.

Changing the title of this ticket. Maybe there is something that can be done to improve this and publish immediately, but that can be deferred to 10.4.

To make sure folks are not confused, we will open a doc bug (in the deployment guide perhaps) to explain to folks how to get publishing to happen more quickly.

https://bugzilla.redhat.com/show_bug.cgi?id=1348536

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2468

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.