Enable OCSP checking
If a certificate is issued with a authority information access extension which indicates the OCSP access method and location, one can enable the default implementation of OCSP checker during building or validating a certification path. Maybe you need to check your certificate firstly, in the purpose of making sure it includes a OCSP authority information access extension: #${JAVA_HOME}/bin/keytool -printcert -v -file target.cert You are expected to see similar lines in the output: #3: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false AuthorityInfoAccess [ [accessMethod: 1.3.6.1.5.5.7.48.1 accessLocation: URIName: http://onsite-ocsp.verisign.com] ] In the above output, "http://onsite-ocsp.verisign.com" indicates the location of the OCSP service. If you find one of similar authority information access extension in your certificate path, you need to enable OCSP checker. For Sun PKIX implementation, OCSP checking is not enabled by default for compatibility, note that ...