1

I have a certificate that is configured in IIS in windows server 2012 with ocsp_uri.

When I test the server for oscp stapling there is no response:

openssl s_client -connect example.com:443 -tls1 -tlsextdebug -status

OCSP response: no response sent

From the server when I test the access to ocsp responder with:

openssl ocsp -issuer sub.class1.server.ca.pem -cert ssl.crt -text -url http://ocsp.startssl.com/sub/class1/server/ca -header "HOST" "ocsp.startssl.com"

I get a response. (the request need to be http/1.1)

How can I check why the ocsp stapling is not being returned by IIS?

Pedro Custódio
  • 111
  • 5
  • Is your site's binding set to "Require Server Name Indication"? If so, OCSP stapling won't work: http://serverfault.com/questions/800829/enabling-ocsp-stapling-on-iis-sni-enabled-site, and you would also have to add -servername to your openssl command to be sure to test the right site. – franzo Sep 02 '16 at 22:43

1 Answers1

2

Is there an OCSP Responder URL coded in the "Authority Information Access (AIA)" field, where the “Access Method” is “On-line Certificate Status Protocol”? This was a requirement in earlier versions of IIS for OCSP Stapling to work. The other stipulation was to ensure there is no firewall or the firewall is configured to allow outgoing OCSP requests from the server, to the OCSP Responder.

R. Fray
  • 21
  • 1
  • Yes, the certificate has OCSP responder URL. And when I test the access to the responder from the server using openssl it works - but it was necessary to add the header "host" to make the request more HTTP/1.1 like, otherwise the server complained. Maybe that is the problem. Need to check with other CA. – Pedro Custódio May 07 '15 at 17:14