Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

How to increase response time for revocation detection through OCSP

$
0
0

i'm new to managing certificates using microsoft's adcs, so i apologize in advance for my lack of familiarity and expertise. 

so i'm trying to test to see how quickly i can detect through ocsp that a certificate was revoked.  i revoke a certificate, i run bothcertutil -url <certfilename.cer> and certutil -verify <certfilename.cer> to see how long before it shows my certificate as revoked.  it's takes nearly half a day (maybe even more since i started the test close to 5pm one day and no change for the next 2 hours until i check again the next morning before i see the revocation).

so i've got a few questions. 

  1. so when i do a check through certutil -url, it's checking my http://mysitename.com/ocsp, but where does the certutil -verify check?  does it also check http://mysitename.com/ocsp or does it ldap/AD?
  2. when i check for certificate revocation using ocsp, what happens in the background?  am i correct in thinking that the request is sent to my ocsp responder, that i've got setup under Online Responder Management -> Revocation Configuration properties -> Revocation Provider tab -> Provider... -> and the list of locations for the base/delta CRLs?
  3. if the check for certificate revocation using ocsp is using the list of locations for base/delta CRLs under the Revocation Provider tab mentioned above, then how does this increase the time to identify revoked certificates compared to a straight checking of the CRL?
  4. if the checking for the certificate revocation using ocsp is using the list of locations for base/delta CRLs under the Revocation Provider tab mentioned above, then do i need to manually update of the base/delta CRL in order for me to verify a certificate was revoked if i wanted to verify within minutes of the revocation?
  5. as a rewording of question number 4, how do i verify a certificate is revoked through ocsp if i wanted to verify immediately (or at a minimum within minutes) of the certificate being revoked? 
  6. if question number 5 requires me to manually update any CRLs, how do i do that, in particular via the commandline?

i appreciate your help!


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>