0

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is installed on another VM also running Windows Server 2008 R2 and is pointing to the CA and a OCSP Responder Certificate template.

What I haven't been able to do is to remove the AIA and CRL from the certificates. Can someone please help me with this as I have tried to find away? I have been told this is possible!

Thanks

Andy

Andy5
  • 145
  • 1
  • 3
  • 10

2 Answers2

1

Although, this is not an answer, but I would strongly suggest to include CDP extension in issued certificates:

  1. your OCSP server will be a single point of failure.
  2. Windows OCSP server is CRL-based, so you still will have to provide CRL references to your OCSP server.
  3. you should be aware about one CryptoAPI behavior aspect: when client receives many certificates from the same issuer (default value is 50), then CryptoAPI will stop query OCSP and downloads issuer CRL. This CRL is used until it is expired. After CRL expiration, CryptoAPI client starts OCSP usage until "magic" number of certificates from the same issuer is faced. Client will stop working with OCSP and attempts to use CRL. If CryptoAPI client reaches that "magic" number and CRL is not available, certificate chaining engine will report "RevocationOffline" error for this issuer.

you should not decrease your application reliability without necessity, counting that CDP extension doesn't cost you anything.

Crypt32
  • 6,639
  • 1
  • 15
  • 33
0

Solved. All I needed to do was to remove the URL from the AIAs and the CRLs. This stops the attributes being added to the certificate. All revocation checks are being done from ocsp via Oracle Access Manager.

Andy5
  • 145
  • 1
  • 3
  • 10