I have a certificate that is configured in IIS in windows server 2012 with ocsp_uri.

When I test the server for oscp stapling there is no response:

openssl s_client -connect example.com:443 -tls1 -tlsextdebug -status

OCSP response: no response sent

From the server when I test the access to ocsp responder with:

openssl ocsp -issuer sub.class1.server.ca.pem -cert ssl.crt -text -url http://ocsp.startssl.com/sub/class1/server/ca -header "HOST" "ocsp.startssl.com"

I get a response. (the request need to be http/1.1)

How can I check why the ocsp stapling is not being returned by IIS?

  • Is your site's binding set to "Require Server Name Indication"? If so, OCSP stapling won't work: serverfault.com/questions/800829/…, and you would also have to add -servername to your openssl command to be sure to test the right site.
    – franzo
    Sep 2 '16 at 22:43

Is there an OCSP Responder URL coded in the "Authority Information Access (AIA)" field, where the “Access Method” is “On-line Certificate Status Protocol”? This was a requirement in earlier versions of IIS for OCSP Stapling to work. The other stipulation was to ensure there is no firewall or the firewall is configured to allow outgoing OCSP requests from the server, to the OCSP Responder.

  • Yes, the certificate has OCSP responder URL. And when I test the access to the responder from the server using openssl it works - but it was necessary to add the header "host" to make the request more HTTP/1.1 like, otherwise the server complained. Maybe that is the problem. Need to check with other CA. May 7 '15 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.