Расположение ocsp 1 ошибка

Posted by Troy_PacNW 2018-09-11T20:53:42Z

• Anybody?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• revoked the certificate issued for the OCSP…deleted the revocation configuration that used the previous and reissued certificate template.  back to OK in pkiview…for now

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• So after I got it working (see previous), I decided to move the Online Responder off of the ESCA server and on to my web server that works with ESCA.  I’ve rebuilt the certificate, I’ve reinstalled, everything I can think of, multiple times on the WEBCA but it always shows error bad location on the OCSP Location.  Is there something I’m missing on having the online responder on a separate server?  All instructions I’ve found online show you can put it on another server and yet for some reason it’s not working in my instance.

  Since nobody responded previously…do I even have this in the correct category/group?  Is there a CA specific group I should be asking my request in?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• Also, when I issue a cert to another web server it does have the correct AIA info for the OCSP and it does show retrieved as verified when I export and run certutil -url.  However, when I revoke the certificate, then retrieve again, it doesn’t show revoked…but still verified.  I’m assuming this is because of the error in PKIview correct?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• Hey Adam…do you know anything about ADCS and OCSP or know someone who does that could help out in this situation?  I need to get this up and rocking as we are getting ready to make system-wide change to our Okta SSO that requires a local CA and I am also writing up the build-out for the other two sites to use and I’ve got to get this done soon.  Any help would be appreciated.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    44
    Best Answers
  • thumb_up
    170
    Helpful Votes

  When I set mine up, I used: https://blogs.technet.microsoft.com/askds/2009/10/13/designing-and-implementing-a-pki-part-ii-implem… Opens a new window

  I have to publish the revocation list every x amount (I do it twice a year) into AD from my offline root.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• yeah I’ve gone thru all of them multiple times trying to figure out where I’ve gone wrong, yet everything seems to check out as far as I can tell.

  this is the main one that I’ve always referenced when setting things up:  https://social.technet.microsoft.com/wiki/contents/articles/15037.ad-cs-step-by-step-guide-two-tier-… Opens a new window

  referenced this one too since it was on 2016:  https://timothygruber.com/pki/deploy-a-pki-on-windows-server-2016-part-1/ Opens a new window

  there’s also this one too:  https://www.tech-coffee.net/public-key-infrastructure-part-3-implement-pki-active-directory-certific… Opens a new window 

  This is the second go-around on setting up ADCS and this time the only thing that’s different is Server 2016 and using a 3rd server (WEBCA) to house the certs and act as the OCSP.

  But any ideas as to why I’m having an issue with the OCSP location showing up as error as well as when requesting Domain Cert on another IIS I can’t select my local CA?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    44
    Best Answers
  • thumb_up
    170
    Helpful Votes

  Sorry, no idea.

  The guide I used… I had to go through it 3 times… only on the 3rd time did I literally stop at every line and make sure I did it and crossed it off (printed it out). After I had done everything exactly as it goes (the first 2 times I apparently missed a step or more)… then it started to work properly.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• yeah that’s what I’ve done.  I always create an as-built document and I’ve gone thru it a couple times now except for making the change over to the WEBCA.  Everything else shows green and working.  The only thing that shows red/error is the OCSP location…and try as I might I can’t get it to show up OK for OCSP location.  I’ve revoked the OCSP cert…deleted the duplicated cert template…uninstalled OCSP…then redid it and still nothing…even though I did get it working on the ESCA server

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• When I set mine up, I used: https://blogs.technet.microsoft.com/askds/2009/10/13/designing-and-implementing-a-pki-part-ii-implem… Opens a new window

  I have to publish the revocation list every x amount (I do it twice a year) into AD from my offline root.

  Your comment of spinning up the ORCA twice a year to publish the CRL has struck me as odd…it’s been suggested that the root CRL be extremely long – 10 years for example – because the only time the root crl would need updated is when you need to revoke a certificate…aka the ESCA cert. If that’s the case then you would power it on – and generate a CRL. Having to do that that twice a year when nothing is revoked is extra work because the CRL wouldn’t have changed. Is there another reason for you needing to do this twice a year?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    44
    Best Answers
  • thumb_up
    170
    Helpful Votes

  Troy_PBGNW wrote:

  Adam (AJ Tek) wrote:

  When I set mine up, I used: https://blogs.technet.microsoft.com/askds/2009/10/13/designing-and-implementing-a-pki-part-ii-implem… Opens a new window

  I have to publish the revocation list every x amount (I do it twice a year) into AD from my offline root.

  Your comment of spinning up the ORCA twice a year to publish the CRL has struck me as odd…it’s been suggested that the root CRL be extremely long – 10 years for example – because the only time the root crl would need updated is when you need to revoke a certificate…aka the ESCA cert. If that’s the case then you would power it on – and generate a CRL. Having to do that that twice a year when nothing is revoked is extra work because the CRL wouldn’t have changed. Is there another reason for you needing to do this twice a year?

  Next, on lines 10 and 11 we have the following:

  certutil -setreg CACRLPeriodUnits 180
  certutil -setreg CACRLPeriod “Days”

  These set the CRL Validity and Publishing period 180 days or roughly six months.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    44
    Best Answers
  • thumb_up
    170
    Helpful Votes

  BTW, Orca is a product for editing MSI’s I had to think for a second for what you meant.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• lol…yeah I have Orca too sorry about the confusion.

  But hey, I get it that the instruction said to do 6mo…but I’m curious as to why you didn’t change it?  That’s what I’m trying to do right now, go thru all these initial settings again, because I don’t really want to have to do much with ORCA since it’s really only handling ESCA certs and as long as ESCA doesn’t become compromised, then there’s really no reason to bring ORCA online except to renew ESCA’s certificate in 5yrs…

  As well as I don’t want to have it too long for ORCA and then have issues when I need to upgrade the server OS.  I want it long enough that I don’t have to do squat with it, but not too long that it’s a pain for upgrading the OS in 5-10 years.

  Just trying to get real-world thoughts on this since it’s just me, myself, and I here…

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  OverDrive

  
  

  This person is a verified professional.

  Verify your account
  to enable IT peers to see that you are a professional.

  mace

  Windows Server Expert

  • check
    44
    Best Answers
  • thumb_up
    170
    Helpful Votes

  I turn it on every month for windows updates (direct from MS, not from WSUS), and then shut it down after the restart to apply the updates.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• So I don’t get it.  I had to replace my UPS and step-down transformer over the weekend and when I turn the servers back on after also doing Windows Updates for this month, now OCSP Location #1 is no longer in Error…but OK…???  No amount of rebooting the VMs did anything previously…what the…?!

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  Hey Troy,

  I am having the exact same issue, did you ever figure it out mate?

  John

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• johnpala2 wrote:

  Hey Troy,

  I am having the exact same issue, did you ever figure it out mate?

  John

  No…as I stated in my post prior to yours, all of a sudden everything was working correctly after I took the entire office down to replace the UPS…so as to why it was acting like that after I already rebuilt everything…is beyond me…sorry man.

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• 

  Hey Troy,

  I have 2 Issuing CA Servers in my environment and they both have multiple certificates issued to the OCSP Responder.

  That can’t be right… can it?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• johnpala2 wrote:

  Hey Troy,

  I have 2 Issuing CA Servers in my environment and they both have multiple certificates issued to the OCSP Responder.

  That can’t be right… can it?

  I wouldn’t think so but I’m far from a PKI expert…but it’s easy to revoke the certs for OCSP…remove OCSP role and redo it…I did it several times as you can see from the above.  Probably easier to revoke/remove and then redo it.  Are the 2 issuing CA’s both subordinate CA’s?

  
  Was this post helpful?
  thumb_up
  thumb_down
  

• FYI…I’ve ripped mine back out (again) after my home office team and I figured how to set up SSL with Okta in our production environment w/out the need for local CAs…so I’m helping based off memory…

  
  Was this post helpful?
  thumb_up
  thumb_down