locked
Correctly configuring OCSP Responder RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

     I have an incorrect config in my OCSP responder. I have a 2 tier PKI environment with Windows 2012 offline root CA and an enterprise 2012 issuing CA. I'm following the guide here to configure OCSP:

     http://www.tech-coffee.net/public-key-infrastructure-part-8-ocsp-responder/

    I've configured the OCSP role as mentioned, but hit an error during configuration - "Bad Signing Certificate" which I manually managed to get around by enrolling for the OCSP cert manually, changing my template configuration and rebooting. I've configured the OCSP template as follows:

    - validity 2 years
    - compatibility 2012 (as the issuing CA and recipient CA is Windows 2012), I'm not sure if I need to choose XP/2003 for my older clients - I'm not planning on installing any OCSP roles on 2003, but I do have 2003 clients that use AD CS
    - Added a computer group to the template with read, enroll and auto enroll permissions ("pki servers")

    Currently certutil -url mycert.cer works as it shows a healthy OCSP AIA retrieval. 
    The OCSP management console on my enterprise CA shows as healthy.
    PKI.view shows an error against OCSP

    If I revoke a certificate and refresh it in the website browser the certificate does not immediately show as invalid - should it?

    With OCSP is there caching that goes on/needs clearing and do I need to publish a new CRL for revoked certs?

    Is it OK to use a custom certificate template with OCSP?

    See screenshots below

    Thanks

    IT Support/Everything


    • Edited by Aetius2012 Monday, October 5, 2015 7:42 PM
    Monday, October 5, 2015 7:38 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    For the AIA tab, can you please select the actual OCSP URL in your screen shot

    From your certutil -url output, it looks like OCSP is working fine (did I mention that pkiview.msc kind of leaves you wanting for OCSP URL verification). 

    Have you tried revoking the last issue CA Exchange certificate and running certutil -cainfo xchg to generate a new certificate.

    Brian

    Tuesday, October 6, 2015 12:43 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I'm with Brian, I suspect there is an CAExchange certificate that was issued on the CA prior to creating and deploying the OCSP server. Did you get a chance to look for that in the Issued Certificates, revoke it and then refresh the view in PKIView?

    Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com

    • Proposed as answer by Steven_Lee0510 Tuesday, October 20, 2015 2:59 PM
    • Marked as answer by Steven_Lee0510 Tuesday, October 20, 2015 3:13 PM
    Tuesday, October 6, 2015 1:46 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    IT Support/Everything

    Monday, October 5, 2015 7:39 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    IT Support/Everything

    Monday, October 5, 2015 7:40 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks in advance!

    IT Support/Everything

    Monday, October 5, 2015 7:41 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    For the AIA tab, can you please select the actual OCSP URL in your screen shot

    From your certutil -url output, it looks like OCSP is working fine (did I mention that pkiview.msc kind of leaves you wanting for OCSP URL verification). 

    Have you tried revoking the last issue CA Exchange certificate and running certutil -cainfo xchg to generate a new certificate.

    Brian

    Tuesday, October 6, 2015 12:43 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks Brian, on the AIA tab I have selected "Include in the online certificate status protocol (OCSP) extension" only.

    From looking, there's nothing wrong you can see at first glance from my duplicated template? I'm wondering if with OCSP it's invalid to use a custom template somehow

    Thanks

    IT Support/Everything

    Tuesday, October 6, 2015 6:31 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I'm with Brian, I suspect there is an CAExchange certificate that was issued on the CA prior to creating and deploying the OCSP server. Did you get a chance to look for that in the Issued Certificates, revoke it and then refresh the view in PKIView?

    Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com

    • Proposed as answer by Steven_Lee0510 Tuesday, October 20, 2015 2:59 PM
    • Marked as answer by Steven_Lee0510 Tuesday, October 20, 2015 3:13 PM
    Tuesday, October 6, 2015 1:46 PM