PKI + OCSP

[mrbios]

I've been following these guides:

https://www.petenetlive.com/KB/Article/0001312

and

https://www.petenetlive.com/KB/Article/0001084

 

To setup PKI and OCSP. I've got everything set up to the letter based on their instructions, however i don't understand the OCSP part. OCSP is installed and configured, says it's working. However in pkiview.msc it says error, and if i do a url test on a cert it fails.

 

I can't browse to a http://domain.com/ocsp address. Should i be able to? Based on the original instructions, should that actually be pointing to http://domain.com/pki ? It's got me very confused.

 

EDIT: Just found the commend certutil -vocsproot which reset the ocsp store and created the IIS application which wasn't there before. I've now created a cert, exported it and run certutil -URL cert.cer and it comes up as verified in the OCSP part of the url retrieval tool. However i still see an error for OCSP Location in pkiview....

 

EDIT2: Nevermind, found the fix https://blogs.msmvps.com/itcalls/2016/01/17/pkiview-ocsp-location1-error/

 

I think.....touch wood...I've fixed it

Edited March 10, 2020 by mrbios

[mrbios]

Ok new questions:

These guides advise copying all the certs and crls into a pki IIS directory with directory browsing enabled...then they talk about making it public. How public are they talking here? because they're not very specific on that part. If it's a web address i could type in from home and get to for example, doesn't that mean i could then install the root and sub CA certs on my own PC?! (Something tells me i've skipped something in the explanation here)

[Domino]

External publishing is only required if you need to validate the certs from outside.For example, if you were going to use internal certs for VPN connectivity, the CRL would need to be externally accessible.

 

And yes, you could install the trusted certs on a third party device if they're in that directory. If what you're publishing it through supports limiting browsing to specific URLs you could only allow the needed paths though. Regardless that isn't the end of the world - it means the external machine would trust certificates from your CA, it doesn't give it rights to request a cert or anything.

[mrbios]

External publishing is only required if you need to validate the certs from outside.For example, if you were going to use internal certs for VPN connectivity, the CRL would need to be externally accessible.

 

That's the goal, intend on setting up Always on VPN.

 

And yes, you could install the trusted certs on a third party device if they're in that directory. If what you're publishing it through supports limiting browsing to specific URLs you could only allow the needed paths though. Regardless that isn't the end of the world - it means the external machine would trust certificates from your CA, it doesn't give it rights to request a cert or anything.

 

Ok thank you, i think i understand.

 

EDIT: So in that directory i have my SubCA.crl and SubCA.crt, RootCA.crl and RootCA.crt along with a cps.txt file. That's everything that should be in there right? For OCSP and the CRL directory, both need to be publicly available?

Edited March 10, 2020 by mrbios

[Domino]

The CRL and OCSP URLs need to be available *as listed in the Certificates*

 

The checks will look for the URLs as they are on the certs, so that's what needs to be available.