Issues with In-Place Upgrade of Windows OCSP Server
Recently, a client reached out after experiencing issues with an in-place upgrade of a Windows OCSP server. After the upgrade, the Online Responder had a bad signing certificate and would not request a new one. This is a unique case, as the Online Responder server was using a Luna HSM for key protection and had […]
To Revoke or Not to Revoke: Balancing Security with Performance and Operational Complexity
As a PKI engineer, I have consistently faced the challenges associated with certificate revocation. In several positions, I’ve been tasked with implementing automation to perform certificate revocation in bulk. Although I appreciated a task that showcased my coding skills, I often argued against such processes. I believe that many organizations misunderstand certificate revocation and how […]
Windows Server 2016 – What’s New with ADCS
Well, here it is – the concise list of updates and changes to Active Directory Certificate Services (ADCS) for Windows Server 2016. I will go ahead and tell you now that there aren’t any new earth shattering features. Consider this an incremental set of improvements to ADCS. Remember that we still have things like Elliptical Curve […]
PowerShell PKI (PSPKI) 3.7 enhancements – security descriptors
Today I’m starting a series of blog posts where I will explore new features we have added to PowerShell PKI module, version 3.7. First post is dedicated to security descriptors. Major changes in PSPKI Within PSPKI module, we had an ability to manage security descriptors (access control lists) for Certification Authority can certificate template objects. […]
PowerShell PKI (PSPKI) 3.7 enhancements – OCSP Server Management
Today I’m starting a series of blog posts where I will explore new features we have added to PowerShell PKI module, version 3.7. First post is dedicated to Online Responders. The biggest part of this release is Microsoft OCSP Server, or Online Responder management feature. In this post, I will show general Online Responder server […]
PowerShell PKI (PSPKI) 3.7 enhancements – OCSP Revocation Configuration Management
Hello everyone, today is a second post in OCSP server management in Windows PowerShell. First blog post in the series was about OCSP server management. Today, I will discuss about Online Responder revocation configuration management using Windows PowerShell. Intro Every single Microsoft Online Responder is capable to provide certificate status for multiple different certification authorities. […]
OCSP Magic Number
The magic number is a value that states when CRLs will be processed over OCSP, specifically it is when the total number of cached OCSP responses from a single OCSP responder URL on behalf of a single certificate authority will stop performing OCSP and start processing CRLs. This will occur if the number of cached […]
Microsoft OCSP Responders – Trust, Renewals and RFC 6960
Online Certificate Status Protocol (OCSP) provides an efficient mechanism for distributing certificate revocation information. When certificates are exchanged and validated, computers need to determine if the certificate has been revoked – meaning the CA has reason to consider the certificate as untrusted. This often placed in a Certificate Revocation List (CRL). Clients download this potentially large CRL […]