Skip to main content
Verify the IIS configuration on the OCSP and CA servers after the Online Responder role is installed.
IIS is configured on both servers, but they host different virtual directories:
  • OCSP server: ocsp (created automatically when the Online Responder role is configured). On a Standalone CA, the OCSP server also hosts CertEnroll (created manually in Configure Online Responder, Step 2).
  • CA server: CertEnroll (created manually for an Enterprise CA in Configure the CA server for OCSP, “Serve the CRL through IIS”).

​
Verify IIS on the OCSP Server

1
Select Start > Windows Administrative Tools > Internet Information Services (IIS) Manager.
2
In the Connections pane on the left, expand the server node and select Sites > Default Web Site.Verify that the following are listed under Default Web Site:
  • ocsp: present on both CA types.
  • CertEnroll: present on a Standalone CA OCSP server only.
If the ocsp virtual directory is not present, re-run the AD CS Configuration Wizard from the Server Manager notification flag and configure the Online Responder role service. For a Standalone CA, if CertEnroll is not present, refer to Step 2 of the Configure Online Responder page.
3
In the Connections pane, select Default Web Site. In the Actions pane on the right, select Bindings….Verify that an HTTP binding exists on port 80. The Online Responder uses HTTP (not HTTPS) for OCSP requests.
The OCSP protocol communicates over HTTP on port 80 by default. Do not change this to HTTPS unless your environment specifically requires it and your clients are configured accordingly.
4
Select [ Close ] to close the Site Bindings window.

​
Verify the CRL is Reachable

1
Confirm the CRL is accessible over HTTP from the URL embedded in the CDP extension:
  • Standalone CA: served from the OCSP server: http://<OCSP-server-IP>/CertEnroll/<CAName>.crl
  • Enterprise CA: served from the CA server: http://<CA-server-IP>/CertEnroll/<CAName>.crl
Open the URL in a browser, or run from the OCSP server:
Standalone CA: check only the base CRL, which should show StatusCode : 200. A standalone root CA doesn’t publish a delta CRL by default, so the +.crl request returns 404 (IIS substatus 404.11); that is expected.Enterprise CA: both the base CRL and the delta CRL (+.crl) should show StatusCode : 200. If the base CRL returns 200 but the delta returns 404, the IIS site hosting the CRL needs double-escaping enabled so it can serve the + in the delta filename. See “Serve the CRL through IIS (Enterprise CA)” on the Configure the CA server for OCSP page.