| Field | Type | Description | Default Value | Required |
|---|---|---|---|---|
| Only End Entities | Boolean | Only verify the last element of the certificate chain. | ||
| Prefer Crls | Boolean | Try CRL instead of OCSP first. | ||
| No Fallback | Boolean | Do not use the secondary checking method (the one not selected before). | ||
| Soft Fail | Boolean | Avoid verification failure when the revocation server can not be reached or is busy. |