1

I have a certificate that is configured in IIS in windows server 2012 with ocsp_uri.

When I test the server for oscp stapling there is no response:

openssl s_client -connect example.com:443 -tls1 -tlsextdebug -status

OCSP response: no response sent

From the server when I test the access to ocsp responder with:

openssl ocsp -issuer sub.class1.server.ca.pem -cert ssl.crt -text -url http://ocsp.startssl.com/sub/class1/server/ca -header "HOST" "ocsp.startssl.com"

I get a response. (the request need to be http/1.1)

How can I check why the ocsp stapling is not being returned by IIS?

Improve this question
1
  • Is your site's binding set to "Require Server Name Indication"? If so, OCSP stapling won't work: serverfault.com/questions/800829/…, and you would also have to add -servername to your openssl command to be sure to test the right site.
    – franzo
    Sep 2, 2016 at 22:43

1 Answer 1

Reset to default
2

Is there an OCSP Responder URL coded in the "Authority Information Access (AIA)" field, where the “Access Method” is “On-line Certificate Status Protocol”? This was a requirement in earlier versions of IIS for OCSP Stapling to work. The other stipulation was to ensure there is no firewall or the firewall is configured to allow outgoing OCSP requests from the server, to the OCSP Responder.

Improve this answer
1
  • Yes, the certificate has OCSP responder URL. And when I test the access to the responder from the server using openssl it works - but it was necessary to add the header "host" to make the request more HTTP/1.1 like, otherwise the server complained. Maybe that is the problem. Need to check with other CA.
    – Pedro Custódio
    May 7, 2015 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .