Breadcrumbs

Make a Revocation Configuration

To use OCSP you must create a new revocation configuration.

  1. Open the Administrative tool, select Online Responder Management

  2. Launch the Online Responder Management console

  3. Select Revocation Configuration and then click on Action and then Add Revocation Configuration

  4. On the Add revocation wizard, click Next then enter a Name for your configuration

image-20251110-111441.png

Figure 131: Add Revocation Configuration window

  1. Specify the location of your CA certificate relative to your environment

image-20251110-111455.png

Figure 132: Select CA Certificate Location window

  1. Select the OCSP certificate template created earlier and click Browse

  2. Click Next on the Select signing certificate wizard, click Next

image-20251110-111518.png

Figure 133: Select Signing Certificate window

  1. To finish, configure the revocation provider. It is the location where the CRLs or Delta CRLs are stored. The configuration automatically retrieves this information in the CDP extension of the certificate

  2. Once you have setup the Revocation Configuration, The Revocation Configuration Status Box displays the Online Responder status. The status should display Bad Signing on Array Controller.

  3. To fix this, click on Revocation Configuration in the left-hand pane. Right-click on the certificate and select Edit Properties.

  4. Click on the Signing tab. Deselect the Do not prompt for credentials for cryptographic operations check box. Click OK.

  5. Go back to the Online Responder Management tool. Open Actions and click Refresh. Its status would be working now.

  6. You can check if the key to this certificate is really created and stored by the Utimaco CNG provider. To do this, open a PowerShell and enter cngtool listkeys. If there is a key, then you can be assured that your Online Responder Service uses the Utimaco CryptoServer HSM correctly

›_ Console

 
>cngtool listkeys

------------------------------------------------------------------------

Provider : Utimaco CryptoServer Key Storage Provider

Device : 192.168.0.1

Group : win16ocsp

Mode : External Key Storage

------------------------------------------------------------------------

Index AlgId Size Group Name Spec

------------------------------------------------------------------------

1 RSA 2048 win16ocsp tr-OCSPResponseSigning!0028Uti... 0

If you are using Smartcard Authentication, the prompt will go on the PIN Pad device to insert Smartcard and enter the pin. Then press OK button on the PIN Pad.