Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI MMC.

The CA is up and working, the CDP extensions are correctly created, the CRL LDAP and HTTP locations are working, but for some reason the OCSP Responder is not able to verify. I ran a packet capture and it looks like the Enterprise PKI MMC is sending the Get request to the IIS Server, but the server is returning a 404 for the GET request.

It almost seems like the IIS server doesn't know how to pickup or return a response for the OCSP request.

As you might have guessed, I'm pretty new to IIS and OCSP. Please let me know if I can provide any additional clarifying information.

share|improve this question
Information from the Event and IIS logs would be helpful. –  HopelessN00b Sep 21 '12 at 4:07
Have you created a Revocation Configuration for the OCSP Responder so that it knows to answer for the CRL in question? If you've not seen it already, there's a fantastic tutorial on the AskDS blog about this very topic. –  bobmagoo May 23 '13 at 5:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.