---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Enforce OCSP check on network error
# Enforce OCSP check on network error {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 1 minute to read
Learn how to configure the com.glide.communications.httpclient.ocsp_allow_network_error property to prevent bad actors from bypassing Online Certificate Status Protocol (OCSP) checks.
If this property is not set to false, the system treats OCSP validation as successful by default. This occurs when the Online Certificate Status Protocol (OCSP) check encounters a network-related issue such as a timeout or failure to retrieve revocation data.
1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the com.glide.communications.httpclient.ocsp_allow_network_error property exists and is set to false.
## More information {#sc-enforce-ocsp-check-on-network-error__section_qhx_1b1_xwb}
{#sc-enforce-ocsp-check-on-network-error__table_ajc_b43_3kb__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | com.glide.communications.httpclient.ocsp_allow_network_error |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | true |
| Fallback value | true |
| Category | [Communications](https://www.servicenow.com/docs/Ol4HTvWwwFO1g_KjaK_8RQ "This control ensures proper encryption using strong algorithms and ciphers. This includes ensuring the recommended version of TLS is used for client connectivity, use of strong cipher suites, use of trusted and signed certificates, ensuring connections are encrypted between components and logging of connection failures.") |
| Security risk | * Severity score: 5.9 * CVSS score: Medium * Security risk details: An attacker using a revoked certificate can exploit this setting by simply omitting the OCSP response during a connection attempt. In such cases, the client incorrectly accepts the revoked certificate as valid. This undermines the integrity of the Public Key Infrastructure (PKI) and the trust model that underpins secure web communications. The use of revoked certificates is often indicative of malicious activity, unless attributable to temporary synchronization issues between certificate authorities and OCSP responders. {#sc-enforce-ocsp-check-on-network-error__ul_ihv_dvg_1xb} |
| Dependencies and prerequisites | The com.glide.communications.httpclient.ocsp_allow_network_error property has no effect unless the com.glide.communications.httpclient.verify_revoked_certificate property, the overall gate for certificate revocation checking, is set to true. |
| Functional impact | When the com.glide.communications.httpclient.ocsp_allow_network_error property is set to false, an outbound HTTPS connection is not established if the OCSP responder becomes unreachable due to a network error. Network errors include timeouts or DNS failures. Administrators should monitor OCSP responder availability after making this change, as any outbound integration with a temporarily unreachable OCSP responder will fail to connect. |
[ ]
{#sc-enforce-ocsp-check-on-network-error__table_ajc_b43_3kb}