> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure IIS

> Verify IIS configuration on the OCSP and CA servers after the Online Responder role is installed.

Verify the IIS configuration on the OCSP and CA servers after the Online Responder role is installed.

> [!NOTE]
>
> IIS is configured on both servers, but they host different virtual directories:
>
> * **OCSP server:** `ocsp` (created automatically when the Online Responder role is
>   configured). On a **Standalone CA**, the OCSP server also hosts `CertEnroll` (created
>   manually in Configure Online Responder, Step 2).
> * **CA server:** `CertEnroll` (created manually for an **Enterprise CA** in Configure the CA
>   server for OCSP, "Serve the CRL through IIS").

### Verify IIS on the OCSP Server

**Step 1**

Select **Start** > **Windows Administrative Tools** > **Internet Information Services (IIS)
Manager**.

**Step 2**

In the **Connections** pane on the left, expand the server node and select **Sites** >
**Default Web Site**.

Verify that the following are listed under **Default Web Site**:

* **ocsp**: present on both CA types.
* **CertEnroll**: present on a **Standalone CA** OCSP server only.

> [!NOTE]
>
> If the **ocsp** virtual directory is not present, re-run the AD CS Configuration Wizard from
> the Server Manager notification flag and configure the **Online Responder** role service.
> For a Standalone CA, if **CertEnroll** is not present, refer to Step 2 of the Configure
> Online Responder page.

**Step 3**

In the **Connections** pane, select **Default Web Site**. In the **Actions** pane on the
right, select **Bindings...**.

Verify that an HTTP binding exists on port **80**. The Online Responder uses HTTP (not
HTTPS) for OCSP requests.

> [!NOTE]
>
> The OCSP protocol communicates over HTTP on port 80 by default. Do not change this to
> HTTPS unless your environment specifically requires it and your clients are configured
> accordingly.

**Step 4**

Select **\[ Close ]** to close the **Site Bindings** window.

### Verify the CRL is Reachable

**Step 1**

Confirm the CRL is accessible over HTTP from the URL embedded in the CDP extension:

* **Standalone CA**: served from the OCSP server:
  `http://<OCSP-server-IP>/CertEnroll/<CAName>.crl`
* **Enterprise CA**: served from the CA server:
  `http://<CA-server-IP>/CertEnroll/<CAName>.crl`

Open the URL in a browser, or run from the OCSP server:

```powershell theme={null}
Invoke-WebRequest -Uri "http://<CRL-host-IP>/CertEnroll/<CAName>.crl" -UseBasicParsing
Invoke-WebRequest -Uri "http://<CRL-host-IP>/CertEnroll/<CAName>+.crl" -UseBasicParsing
```

> [!TIP]
>
> **Standalone CA:** check only the base CRL, which should show `StatusCode : 200`. A
> standalone root CA doesn't publish a delta CRL by default, so the `+.crl` request returns
> 404 (IIS substatus 404.11); that is expected.
>
> **Enterprise CA:** both the base CRL and the delta CRL (`+.crl`) should show
> `StatusCode : 200`. If the base CRL returns 200 but the delta returns 404, the IIS site
> hosting the CRL needs double-escaping enabled so it can serve the `+` in the delta
> filename. See "Serve the CRL through IIS (Enterprise CA)" on the Configure the CA server
> for OCSP page.