Share via

PKIVIEW shows OCSP error on Location#1

Carl Burch 216 Reputation points
2021-01-02T20:46:24.66+00:00

I have discovered the hard way that certificates with RSA1 are no longer working for some things, and soon may not work for anything. My original CA was set up well over 10 years ago with RSA1 on server 2008 (I think. Might have been server 2003) and migrated up the change to 2016. So it's almost like I've never dealt with this before.

Since I need a CA that will do RSA256 now, I've decided to wipe out the old completely, and in with the new.
I am making my umpteenth attempt at setting up my own PKI infrastructure setup from scratch on Server 2019. To get this right, I'm using two VMs installed via HYPER-V, both with Server 2019 on them. One is the root CA and the other is the subordinate CA. Doing it this way so that I don't have to deal with server activation licensing until after I've got this down pat.

I found an outstanding step-by-step guide on line at https://mjcb.io/blog/2020/03/09/certificate-authority-windows-server-2019/ that so far, meets my needs exactly.

Upon completion of Part 4 up to an including section 4.5 I run PKVIEW.MSC on the CA Server computer and it shows an error on OCSP Location#1. Now one thing I note as that the instructions do no tell me to enable directory browsing on the OCSP container in IIS.
Am I correct in assuming that’s an oversight? With that assumption I have enabled directory browsing on that container. However, even after an iisreset and restarting the certsvc service, pkivew.msc still shows an error on http://ocsp.bcs.loca/ocsp. Am I missing something? Or am I just checking this with pkiview.msc to early?

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,902 questions
Accepted answer
  1. Carl Burch 216 Reputation points
    2021-01-02T21:45:53.37+00:00

    After some exhaustive searching I found it. Had to revoke the XCHG certificate and issue a new one. The zinger is, after finding this "the long way", when I continued the instructions, they told me to do what took me 45 minutes to discover the hard way. This is called "going around your elbow to get to your thumb." :)

    1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vicky Wang 2,736 Reputation points
    2021-01-06T08:16:26.407+00:00

    Hi,

    I am glad to hear that your issue was successfully resolved\I am pleased to know that the information is helpful to you. If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,
    Vicky

    0 comments
  2. Jon Fourneau 0 Reputation points
    2023-07-20T19:42:58.36+00:00

    For anybody else that finds there way here, there is an updated version of the blog post referenced above. The update details the resolution in Step 4.7

    https://docs.mjcb.io/microsoft/windows-server/windows-server-roles-features/adcs/adcs-windows-server-2019/

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.