Contents
When does the OCSP responder receive the request?
When the OCSP Responder receives the request from the client it then needs to determine the status of the certificate using the serial number presented by the client. First the OCSP Responder determines if it has any cached responses for the same request.
How to create an OCSP response signing template?
If you are using the OCSP with a Windows Server 2008 Enterprise CA, in the Request Handling tab of a Version 3 Certificate Template there is the option to Add Read permissions to Network Service on the private key . This option is enabled by default on the OCSP Response Signing template.
How to get an OCSP response when a certificate is revoked?
This will open the URL Retrieval Tool Select OCSP, and click on the Retrieve button. If the certificate is valid you will get the following response. If the certificate is revoked, you will get the following response. And if it fails, the status will be listed as Failed.
How to implement a high availability OCSP configuration?
In this section I would like to talk about how to implement a High Availability OCSP Configuration. There are two major pieces in implementing the High Availability Configuration. The first step is to add the OCSP Responders to what is called an Array.
What are the server and client components of OCSP?
There are server/client components to OCSP: The OCSP responder, which is the server component, and the OCSP Client. The OCSP Responder accepts status requests from OCSP Clients. When the OCSP Responder receives the request from the client it then needs to determine the status of the certificate using the serial number presented by the client.
How can I check if my OCSP certificate has been revoked?
If it does, it can check the revocation status locally, and send a response to the client stating whether the certificate is valid or revoked. The response is signed by the OCSP Signing Certificate that is selected during installation.
How does OCSP reduce the overhead associated with CRLs?
OCSP reduces the overhead associated with CRLs. There are server/client components to OCSP: The OCSP responder, which is the server component, and the OCSP Client. The OCSP Responder accepts status requests from OCSP Clients.