> Source: [sk181267](https://support.checkpoint.com/results/sk/sk181267)

# sk181267 - VPN authentication with certificates fails with the error "OCSP response time obsolete"

| Property | Value |
|----------|-------|
| Solution ID | sk181267 |
| Date Created | 2023-07-17 |
| Last Modified | 2023-07-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Remote Access VPN authentication using certificates fails with the error message "*OCSP response time obsolete*".
* VPND debugs show these error messages:

  ```
  
  [OCSP] isReplyTimeRecent: reply from responder is updated to: Thu Jan  1 00:59:59 1970 (-1)
  [OCSP] fwFetchOCSP_cb: the reply is too old
  [OCSP] fwFetchOCSP_cb: Not expecting other replies for this level (0). Validation failed
  ```

* A packet analyzer (example: WiresharK) shows a timestamp with a fractionalized value for the OCSP response. For example, for the timestamp `2023 March 10 09:54:10` the OSP response shows: 20230310095410.235734Z On older Wireshark versions this may appear as: `BER Error: GeneralizedTime invalid format 20230310095410.235734Z`

## Cause

Online Certificate Status Protocol (OCSP) responses do not usually have a fractionalized timestamp value (a value with a decimal in it). The Remote Access VPN Gateway parses the timestamp as `-1`, which means `Thu Jan 1 00:59:59 1970` in epoch time. As a result, the gateway considers the reply too old and drops it.  

RFC5280 indicates that GeneralizedTime "MUST NOT" contain fractionalized seconds: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5.2

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content