> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Pre-deployment requirements, recommended architecture, CA-type differences, and network requirements for the Microsoft OCSP with IIS integration with the Excrypt HSM.

Verify your environment meets these requirements before you configure the Online Responder.

## Recommended architecture

> [!NOTE]
>
> This guide assumes the Online Responder and IIS are installed on a dedicated Windows Server
> separate from the CA server. This is the recommended production architecture. If you are
> installing the Online Responder on the same server as your CA, the steps are identical, but
> note that this configuration is not recommended for production environments.

This guide documents the **separate CA and OCSP servers** architecture. A combined CA and OCSP
server is supported, but it is not recommended for production environments because it places the
revocation responder on the same host as the issuing CA. Advanced topologies, such as a CA array
or load-balanced responders, are out of scope for this guide.

## CA type

> [!NOTE]
>
> This guide covers both **Standalone CA** and **Enterprise CA** configurations. Steps that
> apply to only one CA type are clearly marked. If a step has no label, it applies to both.
>
> * **Standalone CA:** Operates independently without Active Directory. The OCSP signing
>   certificate is enrolled using an INF file and `certreq`, then manually approved on the CA.
>   No domain membership is required.
> * **Enterprise CA:** Integrated with Active Directory. The OCSP signing certificate is
>   enrolled from an AD certificate template. The CA server and OCSP server must be
>   domain-joined before proceeding.

## IIS requirements

The servers that require IIS depend on your CA type. IIS installation is covered in this guide.

* **CA server** serves `CertEnroll`: the CRL files and CA certificate. This is the CDP
  (CRL Distribution Point) embedded in every issued certificate.
* **OCSP server** serves `ocsp`: the Online Responder endpoint clients query for real-time
  revocation status. This is the AIA OCSP URL embedded in every issued certificate.

For a **Standalone CA**, IIS is typically only required on the OCSP server. CRL files are copied
there manually. For an **Enterprise CA**, the CA publishes and serves its own CRL, so IIS is
required on the CA server as well.

## Supported hardware

* Excrypt HSM (formerly Vectera Plus), firmware `7.2.x.x` or later.

## Recommended operating systems

* Windows 2016 or later.

## Required access

* An account on the Excrypt HSM with administrator permissions to create application partitions, identities, TLS PKI, and update system settings.
* Local administrator access on the Windows Server where you will install the Online Responder, and on the CA server.

## Network and firewall

* Allow outbound TCP port **9100** (default Excrypt port) from the OCSP server to the Excrypt HSM, specified by FQDN (for example, `hsm.example.com`) or CIDR (for example, `192.0.2.0/24`). For an Enterprise CA where the OCSP signing certificate is enrolled from a template, the CA server also requires this connectivity.

> [!WARNING]
>
> TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the Excrypt HSM FQDN(s)
> from inspection. Configure the Excrypt HSM with a FQDN so the exemption applies.

## Prerequisites

* On the CA server, AD CS integration with the Excrypt HSM is completed.
* **Enterprise CA only:** A Domain Controller is available, and the CA server and OCSP server
  are both domain-joined.