Breadcrumbs

Make a Revocation Configuration

To use OCSP you must create a new revocation configuration.

  1. Open the Administrative tool and select Online Responder Management.

  2. Launch the Online Responder Management console.

  3. Select Revocation Configuration and then click on Action, and then Add Revocation Configuration.

  4. On the Add revocation wizard, click Next, then enter a Name for your configuration.

image-20250805-113256.png


"Add Revocation Configuration" Window

  1. Specify the location of your CA certificate relative to your environment.

image-20250805-113316.png


"Select CA Certificate Location" Window

  1. Select the OCSP certificate template created earlier and click Browse.

  2. Click Next on the Select signing certificate wizard, click Next.

image-20250805-113405.png


"Select Signing Certificate" Window

  1. To finish, configure the revocation provider. It is the location where the CRLs or Delta CRLs are stored. The configuration automatically retrieves this information in the CDP extension of the certificate.

  2. Once you have set up the Revocation Configuration, the Revocation Configuration Status Box displays the Online Responder status. The status should display Bad Signing on the Array Controller.

  3. To fix this, click on Revocation Configuration in the left-hand pane. Right-click on the certificate and select Edit Properties.

  4. Click on the Signing tab. Deselect the Do not prompt for credentials for cryptographic operations checkbox. Click OK.

  5. Go back to the Online Responder Management tool. Open Actions and click Refresh. Its status would be working now.

  6. You can check if the key to this certificate is really created and stored by the Utimaco CNG provider. To do this, open a PowerShell and enter cngtool ListKeys. If there is a key, then you can be assured that your Online Responder Service uses the Utimaco CryptoServer HSM correctly.

›_ Console

 
> cngtool ListKeys

------------------------------------------------------------

Provider          : Utimaco CryptoServer Key Storage Provider
Device            : <PORT>@<IP>
Group             : CNG
Mode              : Internal Key Storage

------------------------------------------------------------

Index  AlgId        Size   Group            Name                             Spec
---------------------------------------------------------------------------------
1      RSA          2048   CNG              utimaco-adcs-UtimacoADCSServ-CA  0

If you are using smartcard authentication, the prompt will appear on the PIN Pad device to insert the smartcard and enter the PIN. Then, press the OK button on the PIN Pad.