How to change OCSP location from 'Default Web Site' to a different web site in IIS on Windows Server 2012 R2 ?

-

i working on setting online responder on windows server 2012 r2 server. default ocsp configuration puts application named ocsp under 'default web site' in iis, ocsp url ends being, example, http://company.com/ocsp . 

i move ocsp configuration new iis web site, , specify host header in bindings on new web site, ocsp url is, example, http://ocsp.company.com

interestingly, couldn't find official microsoft documentation on this. i'm wondering if changing default ocsp location supported configuration.

i came across detailed blog vadims: http://www.sysadmins.lv/blog-en/moving-online-responder-ocsp-to-custom-web-url.aspx

i completed 2 steps outlined in above article, namely:

1) create new web site appropriate parameters:

new-website -name ocsp -applicationpool ocspisapiapppool -hostheader ocsp.company.com -physicalpath "c:\windows\systemdata\ocsp"

2) in applicationhost.config file, change line <location path="default web site/ocsp">     <location path="ocsp"> 

and, of course, dns has been updated point ocsp.company.com ocsp web server. 

i made sure aia extension of issuing ca updated location http://ocsp.company.com , , 'include in online certificate status protocol (ocsp) extension' checkbox checked.

when internet explorer tries perform ocsp check for certificate validation when web site loads, 500 error returned. see 500 error in fiddler, , since ocsp response fails, can see crls being downloaded fallback, before page loads.

has here got custom ocsp location working ? appreciate pointers or advice.

thanks,

mario


just make more clear. ocsp web application migration dedicated web site technically possible, not supported microsoft. why added special disclaimer @ top of blog post. if this doesn't work, suggest revert changes default installation.

it appears that there dependency i'm not aware of , works , not.

in order restore default ocsp application, should run "certutil -vocsproot". command recreate , configure web application default state.

vadims podāns, aka powershell cryptoguy
weblog: www.sysadmins.lv
powershell pki module: pspki.codeplex.com
check out new: ssl certificate verifier
check out new: powershell file checksum integrity verifier tool.




Windows Server  >  Security



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = ce...
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer foll...
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically....
Read more