EnforceOCSPCheckOnNetworkError(Exploring ServiceNow System Properties You Didn’t Even Know Existed)

[TharaS657398130]

If you find this content helpful please upvote, thank you

Forget ServiceNow for now.

Say, for example, you open any secure website, like your bank’s website. Since it is a secure website, it uses HTTPS, and that website provides a certificate which basically says, “Yes, I am the correct website you are trying to connect to, and this connection is secure.”

Now, say that certificate somehow gets stolen or compromised. In that case, the company can revoke that certificate. Revoking basically means telling everyone, “Do not trust this certificate anymore.”

Think about it like your bank card. If your bank card gets stolen, you call the bank and tell them to block the card. Once the bank blocks it, that card should no longer be trusted or accepted. Certificate revocation works in a similar way.

This is where OCSP comes into the picture.

OCSP stands for Online Certificate Status Protocol, and its job is basically to ask, “Is this certificate still valid, or has it been revoked?”

Now let’s bring ServiceNow into the picture.

When ServiceNow connects to an external system over HTTPS, the external system sends its certificate to ServiceNow. ServiceNow validates the certificate, and OCSP can then check whether that certificate has been revoked or not.

Now, say there is some timeout issue or a network problem while ServiceNow is trying to perform the OCSP check. This is where Enforce OCSP Check on Network Error comes into the picture.

The first possibility is that ServiceNow says, “Okay, there is a network error while performing the OCSP check, so I couldn't verify whether the certificate has been revoked. Since I cannot verify it, I will not trust the connection and I will stop it.” This is the more secure approach, and this is when the property is set to false.

The second possibility is that ServiceNow says, “Okay, there is a network error and I couldn't complete the OCSP check, but I will still allow the connection to continue.” This is less secure because ServiceNow is allowing the connection even though it could not confirm the certificate's revocation status, and this is when the property is set to true.

But here is where it gets interesting.

What if the problem is not with the external website at all? What if our OCSP server is down, the firewall is blocking the OCSP request, there is a DNS issue, or there is some other network problem on our side?

That is why the property gives us the option to decide what should happen in that situation. If the property is true, ServiceNow can continue the connection even though the OCSP check could not be completed. If the property is false, ServiceNow takes the safer approach and blocks the connection because it could not verify the certificate's revocation status.

And that is what this property, com.glide.communications.httpclient.ocsp_allow_network_error, is actually controlling.

So, in simple words, it is basically asking:

“If I cannot reach the OCSP server because of a network error, should I still trust the certificate and allow the connection?”

And from a security-hardening perspective, the recommended answer is No — set the property to false.

If you want me to cover more such ServiceNow topics, or if there is any specific system property you would like me to explain in simple terms, feel free to comment below.