This article explains an issue where the OCSP certificate verification fails when tested from SRX CLI.

When you run a command to verify the OCSP status of a local certificate using the command "request security pki local-certificate verify certificate-id xxxx", it fails with the below given error but if you check the actual results using PCAPS or PKID traces you will see the verification actually succeeded:

local certificate "server-cert" verification failed.unreachable CA or CRL download failed

This is an expected behaviour in junOS versions prior to 26.1 if the ca-profile name where you have enabled OCSP check does not match with the actual certificate common name. You need to make sure these two match for the OCSP cert verification status to show the correct results, as given below:

User@srx> show configuration security pki ca-profile MyIntermediateCA                         
ca-identity MyIntermediateCA;
revocation-check {
    use-ocsp;
    ocsp {
        url http://192.168.1.1:8080;
    }
    crl {
        disable on-download-failure;
    }
}

User@srx> show security pki ca-certificate ca-profile MyIntermediateCA 
LSYS: root-logical-system
  CA profile: MyIntermediateCA
Certificate identifier: MyIntermediateCA
  Issued to: MyIntermediateCA, Issued by: CN = MyRootCA
  Validity:
    Not before: 12- 2-2025 17:18 UTC
    Not after: 12- 1-2030 17:18 UTC
  Public key algorithm: rsaEncryption(2048 bits)
  Keypair Location: Keypair generated locally

User@srx> request security pki local-certificate verify certificate-id server-cert

Local certificate server-cert revocation check is in progress.Please check the PKId debug logs for completion status

This applies to the scenarios where the OCSP verification actually succeeds but the CLI command displays a failure message.