How do I test Microsoft OCSP responder?
in the opened dialog box switch radiobutton to OCSP and click Verify. This will return Verified if OCSP is working and certificate is ok. Also you can use ‘certutil -verify -urlfetch’ command to validate certificate and certificate chain. During this test certutil will check certificate revocation status through OCSP.
What does an OCSP responder do?
An OCSP responder (a server typically run by the certificate issuer) may return a signed response signifying that the certificate specified in the request is ‘good’, ‘revoked’, or ‘unknown’. If it cannot process the request, it may return an error code. OCSP can support more than one level of CA.
How do you implement an OCSP responder?
Solution
- Locate the OCSP Response Signing Certificate > Properties.
- Security Tab > Add in the server that will be hosting the OCSP service, (I always use the same server that’s serving my CRL).
- Grant the server read and enroll rights > Apply > OK.
- Then issue the OCSP Responder Template.
What kind of test is used for OCSP?
The Joint Interoperability Test Command (JITC) conducts OCSP Responder testing by using DOD Class 3 PKI test certificates and CRLs issued from the JITC PKI test Certificate Authority.
How to check the status of an OCSP response?
Select OCSP, and click on the Retrieve button. If the certificate is valid you will get the following response. If the certificate is revoked, you will get the following response. And if it fails, the status will be listed as Failed. You can also use the PKIView tool to verify the configurations of the OCSP Responder.
When was Microsoft PKI OCSP responder certified by JITC?
Microsoft’ Online Certificate Status Protocol or “OCSP” responder server role was certified by the Joint Interoperability Test Command (JITC) on 08NOV2013. This certification covers the OCSP responder role on both Windows Server 2008 R2 and Windows Server 2012.
How to install an OCSP responder in command prompt?
To install the OCSP Responder: Open a command prompt and type: servermanagercmd.exe –install ADCS-Online-Cert . First we will add a Revocation Configuration to the OCSP Responder. Right click on the Revocation Configuration and select Add Revocation Configuration from the context menu. The Add Revocation Configuration wizard opens.