Online Responder

The Microsoft Online Responder service makes it possible to configure and manage Online Certificate Status Protocol (OCSP) validation and revocation checking in Windows-based networks. The Online Responder snap-in allows you to configure and manage revocation configurations and Online Responder Arrays to support public key infrastructure (PKI) clients in diverse environments.

  • What Is an Online Responder?

  • Setting Up Online Responder Services in a Network

  • Managing Online Responders

  • Managing a Revocation Configuration

  • Managing an Online Responder Array

  • Troubleshoot Online Responders


What Is an Online Responder?

An Online Responder is a trusted server that receives and responds to individual client requests for information about the status of a certificate.

The use of Online Responders is one of two common methods for conveying information about the validity of certificates. Unlike certificate revocation lists (CRLs), which are distributed periodically and contain information about all certificates that have been revoked or suspended, an Online Responder receives and responds only to individual requests from clients for information about the status of a certificate. The amount of data retrieved per request remains constant no matter how many revoked certificates there might be.

In many circumstances, Online Responders can process certificate status requests more efficiently than by using CRLs. For example:

  • Clients who connect to the network remotely and either do not need nor have the high-speed connections required to download large CRLs.

  • A network needs to handle large peaks in revocation checking activity, such as when large numbers of users log on or send signed e-mail simultaneously.

  • An organization needs an efficient means to distribute revocation data for certificates issued from a non-Microsoft certification authority (CA).

  • An organization wants to provide only the revocation checking data needed to verify individual certificate status requests, rather than make available information about all revoked or suspended certificates.

Additional references

  • Components of an Online Responder

  • How Online Responders Work


Components of an Online Responder

The Online Responder role service in Windows Server 2008 R2 is made up of the following components.

Component Description

Online Responder service

The Online Responder service decodes a revocation status request for a specific certificate, evaluates the status of this certificate, and sends back a signed response containing the requested certificate status information. The Online Responder service is a separate component from a certification authority (CA).

Online Responder

A computer on which the Online Responder service and Online Responder Web proxy are running. A computer that hosts a CA can also be configured as an Online Responder, but you should maintain CAs and Online Responders on separate computers. A single Online Responder can provide revocation status information for certificates issued by a single CA or multiple CAs. CA revocation information can be supported by more than one Online Responder.

Note

An Online Responder can be installed on any computer running Windows Server 2008 R2 Enterprise or Windows Server 2008 R2 Datacenter. The certificate revocation data is derived from a published certificate revocation list (CRL) that can come from a CA on a computer running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or Windows 2000 Server, or from a non-Microsoft CA.

Online Responder Web proxy

The service interface for the Online Responder is implemented as an Internet Server API (ISAPI) extension hosted by Internet Information Services (IIS). The Web proxy receives and decodes requests, and caches responses for a configurable period of time.

Revocation configuration

A revocation configuration includes all of the settings that are needed to respond to certificate status requests that have been issued by using a specific CA key. These configuration settings include the CA certificate, the signing certificate for the Online Responder, and the type of revocation provider to use.

Revocation provider

A revocation provider is the software module that, in conjunction with other revocation configuration settings, enables an Online Responder to check the status of a certificate. The revocation provider in Windows Server 2008 R2 uses data from CRLs to provide this status information.

Online Responder Array

An Online Responder Array contains one or more member Online Responders. Additional Online Responders can be added to an Online Responder Array for a number of reasons, including geographic considerations, scalability, network design considerations, or fault tolerance if an individual Online Responder becomes unavailable. Responders in an Online Responder Array are referred to as Array members.

Online Responder Array controller

When multiple Online Responders are combined in an Array, one member of the Array must be designated as the Array controller. Although each Online Responder in an Array can be configured and managed independently, in case of conflicts the configuration information for the Array controller will override configuration options set on other Array members.

Additional references

  • What Is an Online Responder?

  • How Online Responders Work


How Online Responders Work

Most applications that depend on X.509 certificates need to validate the status of the certificates used when performing authentication, signing, or encryption operations. This certificate validity and revocation check is performed on all certificates in a certificate chain, up to the root certificate. If the root certificate, or any certificate in the chain, is invalid, then the certificates below the invalid certificate in the chain are also invalid.

The validation includes the following:

  • Each certificate's signature is valid.

  • The current date and time are within each certificate's validity period.

  • No certificate is corrupt or malformed.

In addition, each certificate in the certificate chain is checked for its revocation status. Revocation checking can be performed by using either a certificate revocation list (CRL) or Online Certificate Status Protocol (OCSP) response.

What is OCSP?

The Microsoft Online Responder implements the OCSP protocol, which allows a recipient of a certificate to submit a certificate status request to an OCSP responder by using the Hypertext Transfer Protocol (HTTP). This OCSP responder returns a definitive, digitally signed response indicating the certificate status. The amount of data retrieved per request is constant regardless of the number of revoked certificates in the CA.

For more information, see RFC 2560, "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP" (http://go.microsoft.com/fwlink/?LinkID=71068).

Online Responder

The Microsoft implementation of OCSP—the Online Responder—is divided into client and server components. The client component is built into the CryptoAPI 2.0 library, while the server component is introduced as a new service provided by the Active Directory Certificate Services (AD CS) server role. The following process describes how the client and server components interact:

  1. When an application attempts to verify a certificate that specifies locations to OCSP responders, the client component first searches local memory and disk caches to find a cached OCSP response that contains current revocation data.

  2. If an acceptable cached response is not found, a request is sent to an Online Responder by using the HTTP protocol.

  3. The Online Responder Web proxy decodes and verifies the request. If the request is valid, the Web proxy cache is checked for the revocation information needed to fill the request. If current information is not available in the cache, the request is forwarded to the Online Responder service.

  4. The Online Responder service takes the request and checks a local CRL, if available, and a cached copy of the most recent CRL issued by the CA.

  5. If the certificate does not appear on the local or cached revocation lists, the revocation provider obtains an updated CA CRL, if available, from the locations listed in the revocation configuration to check the status of the certificate. The provider, in turn, returns the status of the certificate to the Online Responder service.

  6. The Web proxy then encodes and sends the response back to the client to notify the client that the certificate is valid. It also caches a copy of the response for a limited time in case there are additional status requests about this certificate.

Additional references

  • What Is an Online Responder?

  • Components of an Online Responder


Setting Up Online Responder Services in a Network

Setting up Online Responder services involves several interrelated steps. Several of these steps must be performed on the certification authority (CA) that will be used to issue the Online Certificate Status Protocol (OCSP) signing certificates necessary for an Online Responder to function. These steps include configuring the appropriate certificate template, enabling the certificate template, and configuring and completing certificate autoenrollment so that the computer hosting the Online Responder has the certificates needed for the Online Responder to function.

Installation and configuration of an Online Responder involves using Server Manager to install the Online Responder service, the Certificate Templates snap-in to configure and publish OCSP Response Signing certificate templates, the Certification Authority snap-in to include OCSP extensions in the certificates that it will issue and to issue OCSP Response Signing certificates, and the Online Responder snap-in to create a revocation configuration.

The following topics describe the steps needed to complete these installation and configuration steps and how to verify that the installation was successful.

  • Configure a CA to Support OCSP Responders

  • Set Up an Online Responder

  • Creating a Revocation Configuration

  • Verify an Online Responder Installation


Configure a CA to Support OCSP Responders

To function properly, an Online Responder must have a valid Online Certificate Status Protocol (OCSP) Response Signing certificate. This OCSP Response Signing certificate is also needed if you are using a non-Microsoft OCSP responder.

Configuring a certification authority (CA) to support OCSP responder services includes the following steps:

  1. Configure certificate templates and issuance properties for OCSP Response Signing certificates.

  2. Configure enrollment permissions for any computers that will be hosting Online Responders.

  3. If this is a Windows Server 2003–based CA, enable the OCSP extension in issued certificates.

  4. Add the location of the Online Responder or OCSP responder to the authority information access extension on the CA.

  5. Enable the OCSP Response Signing certificate template for the CA.

The certificate template used to issue an OCSP Response Signing certificate must contain an extension titled "OCSP No Revocation Checking" and the OCSP Signing application policy. Permissions must also be configured to allow the computer that will host the Online Responder to enroll for this certificate.

The following procedure is for a CA that is installed on a computer running Windows Server 2008 R2 or Windows Server 2008.

Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To configure the certificate template for an OCSP Response Signing certificate issued by a Windows Server 2008 R2–based CA or a Windows Server 2008–based CA

  1. Open the Certificate Templates snap-in.

    Note

    If you are completing this procedure on a computer that does not have a CA or Online Responder installed, you may need to install the Active Directory Certificate Services (AD CS) Remote Server Administration Tools in order to use the Certificate Templates snap-in. For more information about the Remote Server Administration Tools, see Administer an Online Responder from Another Computer.

  2. Right-click the OCSP Response Signing template, and then click Properties.

  3. Click the Security tab. Under Group or user name, click Add.

  4. Click Object Types, select the Computers check box, and then click OK.

  5. Type the name of or browse to select the computer hosting the Online Responder or OCSP responder services, and click OK.

  6. In the Group or user names dialog box, click the computer name, and in the Permissions dialog box, select the Read and Enroll check boxes. Then click OK.

The following procedure is for a CA that is installed on a computer running Windows Server 2003. The procedure must be completed on a computer running Windows Server 2008 R2 or Windows Server 2008.

Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To configure the certificate template for an OCSP Response Signing certificate issued by a Windows Server 2003–based CA

  1. Open the Certificate Templates snap-in.

  2. Right-click the OCSP Response Signing template, and then click Duplicate. Click Windows 2003 Server, Enterprise Edition, and then click OK.

  3. Click the Security tab. Under Group or user name, click Add, and then type the name of or browse to select the computer hosting the Online Responder or OCSP responder services.

  4. Click Object Types, select the Computers check box, and then click OK.

  5. Type the name of or browse to select the computer hosting the Online Responder or OCSP responder services, and click OK.

  6. In the Group or user names dialog box, click the computer name, and in the Permissions dialog box, select the Read and Enroll check boxes.

Note

The default OCSP Response Signing certificate template contains an extension titled "OCSP No Revocation Checking." Do not remove this extension, which is used by many clients to verify that responses signed with the signing certificate are valid.

If the CA is installed on a computer running Windows Server 2003, you must complete the following procedure in order to configure the policy module on the CA to issue certificates that include this extension.

You must be a local administrator to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To prepare a computer running Windows Server 2003 to issue OCSP Response Signing certificates

  1. On the server hosting the CA, open a command prompt, and type:

    certutil -v -setreg policy\EnableRequestExtensionList +1.3.6.1.5.5.7.48.1.5

  2. Stop and restart the CA. You can do this at a command prompt by running the following commands:

    net stop certsvc
net start certsvc

To configure your CA for OCSP, you must use the Certification Authority snap-in to complete the following CA configuration steps:

  • Add the location of the Online Responder or OCSP responder to the authority information access extension.

  • Enable the certificate template for the CA.

You must be a CA administrator to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To configure a CA to support an Online Responder or OCSP responder services

  1. Open the Certification Authority snap-in.

  2. In the console tree, click the name of the CA.

  3. On the Action menu, click Properties.

  4. Click the Extensions tab.

  5. In the Select extension list, click Authority Information Access (AIA), and then click Add.

  6. Specify the locations from which users can obtain certificate revocation data, such as http://computername/ocsp.

  7. Select the Include in the online certificate status protocol (OCSP) extension check box.

  8. In the console tree of the Certification Authority snap-in, right-click Certificate Templates, and then click New Certificate Templates to Issue.

  9. In Enable Certificate Templates, select the OCSP Response Signing template and any other certificate templates that you configured previously, and then click OK.

  10. Double-click Certificate Templates, and verify that the modified certificate templates appear in the list.

Additional references

  • Setting Up Online Responder Services in a Network

  • Renew OCSP Response Signing Certificates with an Existing Key


Set Up an Online Responder

An Online Responder can be installed on any computer running Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Datacenter, Windows Server 2008 Enterprise, or Windows Server 2008 Datacenter. The certificate revocation data can come from a certification authority (CA) on a computer running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or from a non-Microsoft CA.

Note

Internet Information Services (IIS) must also be installed on this computer before the Online Responder can be installed.

The following procedure can be used if none of the Active Directory Certificate Services (AD CS) role services (such as a CA) have been installed on this computer.

Membership in local Administrators, or equivalent, is the minimum required to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To install the Online Responder service

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. Click Manage Roles. Under Active Directory Certificate Services, click Add role services. If a different AD CS role service has already been installed on this computer, select the Active Directory Certificate Services check box in the Role Summary pane, and then click Add role services.

  3. On the Select Role Services page, select the Online Certificate Status Protocol check box.

    A message appears explaining that IIS and Windows Activation Service (WAS) must also be installed to support OCSP.

  4. Click Add required role services, and then click Next three times.

  5. On the Confirm Installation Options page, click Install.

  6. When the installation is complete, review the status page to verify that the installation was successful.

Additional considerations

  • Before an Online Responder can be used, you must also create a revocation configuration. See Creating a Revocation Configuration.

  • By default, IIS 7.0 request filtering blocks the plus sign (+), which is used in the URL of delta CRLs. To allow delta CRL retrieval, modify the IIS configuration by setting allowDoubleEscaping=true on the requestFiltering element in the system.web section of IIS configuration. For more information about IIS 7.0 request filter configuration, see IIS 7.0: Configure Request Filters in IIS 7.0 (http://go.microsoft.com/fwlink/?LinkId=136512.)

    Security Note

    Allowing certain characters to pass through the request filter can result in a reduced security level, which might be unacceptable in some environments. For an explanation of this type of threat, see chapter 12 of Writing Secure Code (http://go.microsoft.com/fwlink/?LinkId=136514).

Additional references

  • Setting Up Online Responder Services in a Network


Creating a Revocation Configuration

An Online Responder can make revocation information available from multiple certification authorities (CAs) and multiple CA certificates. However, each CA and CA certificate served by an Online Responder requires a separate revocation configuration.

A revocation configuration includes all of the settings that are needed to respond to status requests regarding certificates that have been issued by using a specific CA key. These configuration settings include the following:

  • CA certificate. This certificate can be located in Active Directory Domain Services (AD DS), in the local certificate store, or imported from a file.

  • Signing certificate for the Online Responder. This signing certificate can be selected automatically for you, selected manually (which involves a separate import step after you add the revocation configuration), or you can use the selected CA certificate to also serve as the signing certificate.

  • Revocation provider. The revocation provider will provide the revocation data used by this configuration. For a Windows Server 2008 R2 or Windows Server 2008 provider, this information is entered as one or more URLs where valid base CRLs and delta CRLs can be obtained.

Before you begin to add a new revocation configuration, make sure you have the information in the preceding list available.

You must have Manage Online Responder permissions on all of the Online Responders in the Array to complete this procedure. For more information about administering a public key infrastructure, see Implement Role-Based Administration.

To add a revocation configuration to an Online Responder

  1. Open the Online Responder snap-in.

  2. In the console tree, click Revocation Configuration.

    A list of existing revocation configurations appears in the details pane.

  3. In the Actions pane, click Add Revocation Configuration to start the Add Revocation Configuration Wizard.

  4. Provide the information requested in the wizard.

    • For information about the Select CA Certificate Location page, see Revocation Configuration CA Certificates.

    • For information about the Select Signing Certificate page, see Revocation Configuration Signing Certificates.

  5. When all the information has been entered, click Finish, and then click Yes to complete the setup process.

You can modify the properties of an existing revocation configuration, view its CA certificate, or delete the revocation configuration, by selecting the revocation configuration and clicking Edit Properties in the Actions pane.

The following properties of a revocation configuration can be modified:

  • Local CRL. For more information, see Manage Revocation Data by Using Local CRLs.

  • Revocation provider. For more information, see Revocation Provider Properties.

  • Signing. For more information, see Revocation Provider Signing.

Additional references

  • Setting Up Online Responder Services in a Network


Revocation Configuration CA Certificates

Use the following criteria to select the revocation configuration certificate:

  • If the certification authority (CA) certificate has been published to Active Directory Domain Services (AD DS) and the computer you are configuring has access to this information in AD DS, click Select a certificate for an existing enterprise CA.

  • If AD DS cannot be accessed and you know the name of the CA certificate and that it exists in the local root certificate store, click Select a certificate from the local certificate store.

    Note

    This option is not available if the Online Responder is not on the same computer as the Online Responder snap-in.

  • If AD DS cannot be accessed and the CA certificate (with a .cer extension) is available on removable media, click Import certificate from a file.

Additional references

  • Creating a Revocation Configuration


Revocation Configuration Signing Certificates

The following options are available for selecting a revocation configuration signing certificate:

  • The default option, Automatically select a signing certificate, will generally meet most organization's needs. This option allows the revocation configuration setup process to identify a suitable signing certificate in the local certificate store. However, if you also enable an option to automatically enroll for a signing certificate, the Online Responder service will enroll for and use that signing certificate.

  • When selecting Manually select a signing certificate, the Online Responder will not assign any signing certificate and the user will have to manually select a signing certificates for each of the Online Responder Array members.

  • Use the CA certificate for the revocation configuration can be selected if the Online Responder is installed on the same computer as the certification authority (CA).

Note

The default installation of Online Responder services does not allow for automatic enrollment of the Online Certificate Status Protocol (OCSP) Response Signing certificate from a hardware security module (HSM) that requires interaction from the user. If you need to use an HSM to distribute OCSP Response Signing certificates, you must modify the Online Responder service to run as Local System with interaction enabled. In addition, on the Signing tab of the Online Responder Properties page, the Do not display UI for cryptographic operations check box must be cleared.

Additional references

  • Creating a Revocation Configuration


Revocation Provider Properties

The revocation provider retrieves the certificate revocation list (CRL) from a certification authority (CA) and uses the revocation list to determine the revocation status of a certificate. Use the Revocation Provider property sheet to specify one or more locations for a CRL and optional delta CRL, and to define the refresh interval for retrieving updated CRLs.

Base CRL and delta CRL locations

The location of CRLs and delta CRLs can be specified in the formats described in the table below. Any CRL locations defined in the CRL distribution point extension of the CA certificate are added to the revocation provider during installation of the Online Responder service.

Location format | Example
HTTP | http://OnlineResponderHost/OCSP/CRLFile.crl
LDAP | ldap:///CN=CACommonName,CN=CAHostName,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=Fabrikam,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint

Multiple locations can be provided for a CRL. The order of the list defines the order of precedence. A CRL listed at a higher position is used if any two CRLs do not contain the same revocation list.

Refresh interval

The default refresh interval is defined as the CRL validity period. The interval can also be defined in minutes to refresh the CRLs more frequently.

Additional references

  • Creating a Revocation Configuration


Revocation Provider Signing

The Signing tab on the Online Responder Properties page shows the hash algorithm that is used to help verify signing operations for Online Responder responses to clients.

The following signing options can be configured:

  • Do not prompt for credentials for cryptographic operations. If the signing key is strongly protected by an additional password, selecting this option means the Online Responder will not prompt the user for the password and will fail silently.

    Note

    Do not select this option if a hardware security module (HSM) is used to protect private keys.

  • Automatically use renewed signing certificates. Instructs the Online Responder to automatically use renewed signing certificates without asking the Online Responder administrator to manually assign them.

  • Enable NONCE extensions support. Instructs the Online Responder to inspect and process an Online Certificate Status Protocol (OCSP) request that includes a nonce extension. If a nonce extension is included in the OCSP request and this option is selected, the Online Responder will ignore any cached OCSP response and will create a new response that includes the nonce provided in the request. If this option is disabled and a request that includes a nonce extension is received, the Online Responder will reject the request with an "unauthorized" error.

    Note

    The Microsoft OCSP client does not support the nonce extension.

  • Use any valid OCSP signing certificate. By default, the Online Responder will only use signing certificates that are issued by the same certification authority (CA) that issued the certificate being validated. This option allows modifying the default behavior and instructs the Online Responder to use any valid existing certificate that includes the OCSP Signing EKU extension.

    Note

    Clients running versions of Windows earlier than Windows Vista with Service Pack 1 (SP1) do not support this option, and certificate status requests from these clients will fail if this option is selected.

The following Online Responder identifier options can be used to select whether to include the key hash or the subject of the signing certificate in the response:

  • Key hash of the signing certificate. Some cryptographic service providers (CSPs) require the key hash of the signing certificate in order to access private keys.

  • Subject of the signing certificate. Some CSPs require the subject of the signing certificate in order to access private keys.

Additional references

  • Creating a Revocation Configuration


Verify an Online Responder Installation

After you have completed setting up an Online Responder, you can verify that it is functioning properly by confirming that you can autoenroll certificates, revoke certificates, and make accurate revocation data available from the Online Responder.

You must be a certification authority (CA) administrator to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To verify that the Online Responder functions properly

  1. On the CA, configure several certificate templates for autoenrollment by computers and users.

  2. After the new certificate templates have been published to Active Directory Domain Services (AD DS), open a command prompt on the client computer and enter the following command to start certificate autoenrollment:

    certutil -pulse

    Note

    It can take several hours for information about new certificates to be replicated to all domain controllers.

  3. On the client computer, use the Certificates snap-in to verify that the new certificates have been issued. If they have not been issued, repeat step 2. You can also restart the client computer to start certificate autoenrollment.

  4. On the CA, use the Certification Authority snap-in to view and revoke one or more of the issued certificates by clicking Certification Authority (Computer)\CA name\Issued Certificates and selecting the certificate you want to revoke. On the Action menu, point to All Tasks, and then click Revoke Certificate. Select the reason for revoking the certificate, and click Yes.

  5. In the Certification Authority snap-in, publish a new certificate revocation list (CRL) by clicking Certification Authority (Computer)\CA name\Revoked Certificates in the console tree. Then, on the Action menu, point to All Tasks, and then click Publish.

  6. On the client computer, use the Certificates snap-in to export one of the issued certificates and save it as an X.509 file.

  7. Open a command prompt, and type the following command:

    certutil –url <exportedcert.cer>

  8. In the URL Retrieval Tool dialog box, select OCSP (from AIA), and then click Retrieve. After the CRL is retrieved, the status will display Verified.

Additional references

  • Setting Up Online Responder Services in a Network


Managing Online Responders

Procedures are available to complete the following basic Online Responder management tasks:

  • Add the Online Responder Snap-in to a Console

  • Audit Online Responder Operations

  • Administer an Online Responder from Another Computer

  • Modify the Online Responder Web Proxy

  • Add OCSP Locations to Issued Certificates

  • Renew OCSP Response Signing Certificates with an Existing Key


Add the Online Responder Snap-in to a Console

You can use the Online Responder snap-in to monitor and manage the Online Responder service and revocation configurations on this computer or another computer.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To add the Online Responder snap-in to a console

  1. Click Start, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, double-click Online Responder, select the computer on which the Online Responder is installed, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. To save this console, on the File menu, click Save.

Additional references

  • Administer an Online Responder from Another Computer


Audit Online Responder Operations

You can monitor the operations of an Online Responder by logging events to the Windows security event log. The Online Responder allows the configuration of the following audit events:

  • Start/Stop the Online Responder Service. Every Start/Stop event of the Online Responder service will be logged.

  • Changes to the Online Responder configuration. All Online Responder configuration changes, including audit settings changes, will be logged.

  • Changes to the Online Responder security settings. All changes to the Online Responder service request and management interfaces access control list (ACL) will be logged.

  • Requests submitted to the Online Responder. All requests processed by the Online Responder service will be logged. This option can create a high load on the service and should be evaluated on an individual basis. Note that only requests that require a signing operation by the Online Responder will generate and audit events; requests for previously cached responses will not be logged.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To enable auditing of Online Responder operations

  1. Open the Online Responder snap-in, and select the Online Responder.

  2. Click Responder Properties on the Action menu, or click Responder Properties in the Action pane.

  3. Click the Audit tab, select the Online Responder audit options that you want to have logged, and then click OK.

Audit events will be logged to the Windows security log only if the Audit object access policy is enabled.

You must be an administrator on the server hosting the Online Responder to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To enable the Audit object access policy

  1. Open the Local Group Policy Editor.

  2. Under Computer Configuration, expand Windows Settings, Security Settings, and Local Policies, and then click Audit Policy.

  3. Double-click the Audit object access policy.

  4. Select the Success and Failure check boxes, and click OK.

Additional references

  • Managing Online Responders

  • Audit Revocation Configuration Changes


Administer an Online Responder from Another Computer

One advantage of Online Responders is that they can be deployed to provide revocation checking services at a remote location or even outside of the local intranet. However, this would frequently require the ability to manage the Online Responder from another computer.

By default, the Online Responder snap-in is installed automatically when an Online Responder is installed on a server. The Online Responder can be installed on a different server by using Server Manager to install Active Directory Certificate Services (AD CS) tools.

Before you can enable remote administration, you must configure Online Responder–related firewall settings on the computer hosting the Online Responder.

You must be a local administrator to configure firewall settings. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To configure firewall settings to enable remote administration of an Online Responder

  1. Open Server Manager.

  2. Under Configuration, expand Windows Firewall with Advanced Security.

  3. Expand Inbound Rules, and click Online Responder Service (DCOM-In).

  4. In the Actions pane, click Enable Rule.

  5. Click Online Responder Service (RPC-In), and in the Action pane, click Enable Rule.

  6. To identify authorized users or computers that can access the Online Responder through each inbound Online Responder firewall rule, in the Actions pane, click Properties for each of these rules, and then click the Users and Computers tab.

You must be a local administrator on the remote computer to install the Remote Server Administration Tools. You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To administer a remote Online Responder

  1. On the remote computer, open Server Manager.

  2. Under Features Summary, click Add Features.

  3. Expand Remote Server Administration Tools and Role Administration Tools.

  4. Select the Active Directory Certificate Services check box, click Next, and then click Install.

  5. When the installation process is finished, click Close.

  6. Click Start, type mmc, and press ENTER.

  7. On the File menu, click Add/Remove Snap-in.

  8. Click the Online Responder snap-in, click Add, and then click OK.

  9. In the console tree, click the Online Responder.

  10. On the Action menu, click Retarget Responder to identify the Online Responder that you want to manage.

Additional considerations

  • If the computer you want to perform remote administration tasks from is running Windows Vista, you can obtain the Remote Server Administration Tools Pack from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkID=89361).

  • If there is a firewall between the Online Responder and the remote computer, the firewall must be configured to allow data to pass through port 80 between Internet Information Services (IIS) and the Online Responder. Similar results can be achieved by using the reverse-proxy capability of Microsoft Internet Security and Acceleration (ISA) Server.

  • It may also be necessary to configure DCOM permissions to enable the Online Responders in an Array to authenticate to each other.

Additional references

  • Managing Online Responders


Modify the Online Responder Web Proxy

The Online Responder Web proxy cache represents the service interface for the Online Responder. It is implemented as an Internet Server Application Programming Interface (ISAPI) extension hosted by Internet Information Services (IIS), and it performs the following operations:

  • Request decoding. After a request is received by the Online Responder Web proxy, the decoder component will try to decode the request and extract the certificate serial number to be validated.

  • Response caching. After a request is received and a certificate serial number is extracted, the Online Responder Web proxy will check the local cache for a valid response. The cache item validity period is set by default to the certificate revocation list (CRL) validity period from which the response was generated.

You can modify the following Web proxy–related settings for an Online Responder:

  • Web proxy threads. This setting refers to the number of threads that will be allocated by the Online Responder ISAPI extension for handling requests. Increasing the number of threads will use more of the server's memory and reducing the number of threads will reduce the number of clients that can be served concurrently.

  • Cache entries allowed. The cache is implemented as part of the Online Responder's ISAPI extension and is an in-memory cache only. The recommended cache size is between 1,000 and 10,000 entries. The minimum cache entries allowed is five. A small cache size will cause more cache faults and will result in a higher load on the Online Responder service for lookup and signing operations; a large cache size will increase the Online Responder's memory usage.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To modify the Online Responder Web proxy

  1. Open the Online Responder snap-in, and select the Online Responder.

  2. Click Responder Properties on the Action menu, or click Responder Properties in the Action pane.

  3. Click the Web Proxy tab, modify the Web proxy options that you want to change, and then click OK.

Additional references

  • Managing Online Responders


Add OCSP Locations to Issued Certificates

The location of an Online Responder is specified as a URL in the authority information access extension in a certificate. When a certification authority (CA) issues a certificate, it adds the authority information access extension to the certificate; when a client needs to check the revocation status of a certificate, it will send the certificate status request to this URL.

The OCSP Properties tab allows you to add Online Responder URLs to previously issued certificates that did not contain an authority information access extension. If an organization adds an Online Responder to an existing public key infrastructure (PKI), this setting allows you to use Online Certificate Status Protocol (OCSP) responses for existing certificates, eliminating the need to reissue the certificates. When you add an OCSP download location for a root or intermediate CA certificate, that location will be used to retrieve the OCSP response for all certificates issued by that particular CA.

Note

The OCSP download locations added through the OCSP Properties tab are checked before any download locations that already exist in a certificate. If you need to add a placeholder URL, use the following address: http://localhost.

Additional references

  • Managing Online Responders


Renew OCSP Response Signing Certificates with an Existing Key

Online Certificate Status Protocol (OCSP) Response Signing certificates need to be signed by the same certification authority (CA) key that was used to sign the end-entity certificates that they provide status for.

After a CA key is renewed, the CA will be using the new key to sign newly issued certificates. In the period between the time a CA certificate is renewed and the expiration date of the original CA certificate, the CA cannot issue or renew OCSP Response Signing certificates, which may prevent an Online Responder from signing OCSP responses.

To overcome this issue, Windows Server 2008 R2–based CAs and Windows Server 2008–based CAs can be configured to modify the default behavior and allow OCSP Response Signing certificates to be issued by using a renewed CA key.

You must be an administrator on the server hosting the CA to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To allow OCSP Response Signing certificates to be renewed by using existing CA keys

  1. On the CA computer, open a command prompt, and type:

    certutil -setreg ca\UseDefinedCACertInRequest 1

  2. Press ENTER.

  3. Restart the CA service.

Additional references

  • Managing Online Responders


Managing a Revocation Configuration

A revocation configuration includes all of the settings that are needed to respond to certificate status requests that have been issued by using a specific certification authority (CA) key. These configuration settings include the CA certificate, the signing certificate for the Online Responder, and the type of revocation provider to use.

Procedures are available to complete the following revocation management tasks:

  • Audit Revocation Configuration Changes

  • Manage Online Responder Security

  • Manage Revocation Data by Using Local CRLs

  • Delete a Revocation Configuration


Audit Revocation Configuration Changes

You can monitor changes to revocation configurations by logging events to the Windows security event log. The Online Responder allows the configuration of the following revocation configuration–related audit events:

  • Changes to the Online Responder configuration. All Online Responder configuration changes, including audit settings changes, will be logged.

  • Changes to the Online Responder security settings. All changes to the Online Responder service request and management interfaces access control list (ACL) will be logged.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To configure auditing of changes to revocation configurations

  1. Open the Online Responder snap-in, and select the Online Responder.

  2. Click Responder Properties on the Action menu, or click Responder Properties in the Action pane.

  3. Click the Audit tab, select the Online Responder audit options that you want to have logged, and then click OK.

Audit events will be logged to the Windows security log only if the Audit object access policy is enabled.

You must be an administrator on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To enable the Audit object access policy

  1. Open the Local Group Policy Editor.

  2. Under Computer Configuration, expand Windows Settings, Security Settings, and Local Policies, and then click Audit Policy.

  3. Double-click the Audit object access policy.

  4. Select the Success and Failure check boxes, and click OK.

Additional references

  • Managing a Revocation Configuration

  • Manage Online Responder Security

  • Manage Revocation Data by Using Local CRLs

  • Delete a Revocation Configuration

  • Audit Online Responder Operations


Manage Online Responder Security

There are three access control entries (ACEs) that can be used to control administrative access to an Online Responder; each can be set to Allow or Deny:

  • Read. Defines who can use the Online Responder snap-in to view information about the Online Responder.

  • Manage Online Responder. Defines who can use the Online Responder snap-in to modify the configuration of the Online Responder. These permissions should be granted very selectively.

  • Proxy Requests. Enables an Online Responder Web proxy to submit requests for certificate status to the Online Responder service.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To modify Online Responder security settings

  1. Open the Online Responder snap-in, right-click the Online Responder that you want to manage, and then click Properties.

  2. Click the Security tab.

  3. Add the user or group that you want to set permissions for, and then select the Allow or Deny check boxes for each ACE.

  4. Click OK.

Additional references

  • Managing a Revocation Configuration

  • Audit Revocation Configuration Changes

  • Manage Revocation Data by Using Local CRLs

  • Delete a Revocation Configuration


Manage Revocation Data by Using Local CRLs

Ideally, certificate revocation data is managed in a central location and immediately made available to all potential users. But this is not always possible in complex network environments.

Organizations that use Online Responders, however, can create a local certificate revocation list (CRL) to manage certificate revocation data locally during intervals when the Online Responder is unable to obtain updated revocation data from a certification authority (CA) or other Online Responder. The next time a connection is established, you can replicate local CRL data back to the CA CRL and remove the local CRL. Until it is removed, the local CRL will always take precedence over the revocation status information from the revocation provider.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To modify certificate data in a local CRL

  1. Open the Online Responder snap-in.

  2. In the console tree, click Revocation Configuration.

    A list of existing revocation configurations appears in the details pane.

  3. Right-click a revocation configuration, and click Local Certificate Revocation List.

  4. In the Local Certificate Revocation List dialog box, select the certificate whose data you want to modify.

  5. Click Update.

  6. Modify the values that you want to change.

  7. Click OK twice to exit the Local Certificate Revocation List dialog box.

When your local revocation data has been synchronized with the revocation data for the entire CA, you should delete all data from the local CRL.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a PKI, see Implement Role-Based Administration.

To delete one or more certificates from a local CRL

  1. Open the Online Responder snap-in.

  2. In the console tree, click Revocation Configuration.

    A list of existing revocation configurations appears in the details pane.

  3. Right-click a revocation configuration, and click Local Certificate Revocation List.

  4. In the Local Certificate Revocation List dialog box, select the certificate or certificates you want to remove from the local CRL.

  5. Click Remove.

  6. Click OK twice to exit the Local Certificate Revocation List dialog box.

Additional references

  • Managing a Revocation Configuration

  • Audit Revocation Configuration Changes

  • Manage Online Responder Security

  • Delete a Revocation Configuration


Delete a Revocation Configuration

Revocation configurations are versatile and can be modified at any time, unless the changes would conflict with settings on the Array controller. However, there may be times when you need to delete a revocation configuration. For example:

  • The CA certificate has expired, and the revocation configuration is no longer needed.

  • The revocation configuration becomes corrupted, and it would be easier to install a new revocation configuration in place of the corrupted revocation configuration.

You must have Manage Online Responder permissions on the server hosting the Online Responder to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To delete a revocation configuration for an Online Responder

  1. Open the Online Responder snap-in.

  2. In the console tree, click Revocation Configuration.

    A list of existing revocation configurations appears in the details pane.

  3. Right-click the revocation configuration that you want to delete, and then click Delete.

Additional references

  • Managing a Revocation Configuration

  • Audit Revocation Configuration Changes

  • Manage Online Responder Security

  • Manage Revocation Data by Using Local CRLs


Managing an Online Responder Array

When multiple Online Responders are used, they need to be organized into a logical framework called an Online Responder Array. Because Online Responders are designed to respond to individual certificate status requests, an Online Responder Array helps distribute status requests among multiple, geographically dispersed Online Responders.

One Online Responder in the Array must be designated as the Array controller. The configuration information for the Array controller determines the configuration options on other members of the Array.

Setting up an Array requires advance planning based on the following:

  • The number and location of the certification authorities (CAs) being supported by the Array.

  • The number of clients who will request certificates from the CAs and their locations.

  • The network connectivity between clients, CAs, and potential Online Responders.

  • The volume of certificate enrollments, certificate revocations, and certificate status requests that the organization's public key infrastructure (PKI) handles.

  • The need for redundancy in case individual Online Responders become unavailable.

Additional references

  • Checklist: Create an Online Responder Array

  • Add Array Members

  • Designate a Controller for the Array

  • Synchronize Members with an Array Configuration

  • Assess Array Member Status

  • Remove a Member from an Array


Checklist: Create an Online Responder Array

After the Online Responder Array has been planned, setting up the Array involves a number of procedures that must be completed in succession.

Task | Reference
Configure a certification authority (CA) to support Online Responders. | Configure a CA to Support OCSP Responders
Set up Online Responders that you intend to add to the Array. | Set Up an Online Responder
Add Online Responders to the Array. | Add Array Members

Additional references

  • Managing an Online Responder Array


Add Array Members

When you create an Online Responder, it does not automatically become a member of an Array. Each Online Responder needs to be added to the Array manually.

You must have Manage Online Responder permissions on all of the Online Responders that you want to add to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To add members to an Array

  1. Open the Online Responder snap-in.

  2. In the console tree, click Array Configuration Members.

  3. In the Actions pane, click Add Array Members.

  4. Type the name and network path of the computer hosting the Online Responder you want to add to the Array, or click Browse to navigate to the Online Responder, and then click OK.

  5. Repeat this procedure for each member that you want to add to the Array.

Additional references

  • Managing an Online Responder Array


Designate a Controller for the Array

When an Array contains multiple Online Responders, one Online Responder in the Array must be designated as the Array controller. Configuration settings on the Array controller override conflicting settings on other Online Responders in an Array.

You must have Manage Online Responder permissions on all of the Online Responders in the Array to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To designate an Array controller

  1. Open the Online Responder snap-in.

  2. In the console tree, click Array Configuration Members.

  3. Select the Online Responder that you want to designate as the Array controller.

  4. In the Actions pane, click Set as Array Controller.

After the new Array controller has been selected, the revocation configuration data from this Online Responder is retrieved and compared against the configuration data for the other Online Responders that are Array members.

Additional references

  • Managing an Online Responder Array


Synchronize Members with an Array Configuration

All Online Responders in an Array must use the same configuration data. The configuration data for an Array is defined on an Array controller. You must synchronize members of the Array with the Array controller to ensure that all members of the Array have the same configuration as the Array controller.

You must have Manage Online Responder permissions on all of the Online Responders in the Array to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To synchronize members with an Array controller

  1. Open the Online Responder snap-in.

  2. In the console tree, click Array Configuration Members.

  3. In the Actions pane, click Synchronize Responder Configuration.

Additional references

  • Managing an Online Responder Array


Assess Array Member Status

Although an Online Responder should perform reliably after it has been set up, an administrator should check the status of the Array and its members regularly.

You can check the status of the Array and its members by using the Online Responder snap-in. Error and warning messages, if any, will appear in the status pane of the snap-in.

If you see an error message or warning message, you may need to check each member of the Array to find out if:

  • A network connection exists. If not, you need to decide how to reestablish connectivity.

  • The service is running. If not, the service needs to be restarted.

  • The certification authority (CA) or signing certificates are about to expire. If so, plan to renew them before they expire.

  • The CA or signing certificates have expired. If so, renew them immediately.

Additional references

  • Managing an Online Responder Array

  • Troubleshoot Online Responders


Remove a Member from an Array

At times you may need to delete a member from an Array if the Array is no longer needed, has become corrupted, has been compromised, or is otherwise being reconfigured.

You must have Manage Online Responder permissions on all of the Online Responders in the Array to complete this procedure. For more information about administering a public key infrastructure (PKI), see Implement Role-Based Administration.

To remove a member from an Array

  1. Open the Online Responder snap-in.

  2. In the console tree, click Array Configuration.

  3. Select the Array member that you want to delete.

  4. On the Action menu or in the Actions pane, click Delete Array Member.

Additional considerations

  • If the Array member that you want to delete is the Array controller, you must first designate a new Array controller for the Array before removing the former Array controller. For more information, see Designate a Controller for the Array.

Additional references

  • Managing an Online Responder Array


Troubleshoot Online Responders

This section lists a few common issues you may encounter when using the Online Responder snap-in or working with Online Responder Arrays. For more information about troubleshooting and resolving problems with Online Responders, see Active Directory Certificate Services Troubleshooting (http://go.microsoft.com/fwlink/?LinkId=89215).

What problem are you having?

  • The Online Responder service did not start

  • The Online Responder's signing certificate could not be located

  • An attempt to create a revocation configuration failed

  • The signing certificate for the Online Responder configuration will expire soon

  • The signing certificate for the revocation configuration has expired

  • An Online Responder revocation configuration cannot be loaded

  • The Online Responder service could not retrieve a CRL for the specified revocation configuration
The Online Responder service did not start.
  • Cause: The Online Responder service can fail to start because of corrupted registry information or insufficient system resources.

  • Solution: Try to restart the Online Responder service from the Services snap-in (Services.msc). If the Online Responder service fails to start, check the event log for other errors that may be related to this failure. If not enough system resources are available to start the Online Responder service, try to restart the computer or free system resources. If the registry information is corrupted, you must use Server Manager to uninstall and reinstall the Online Responder service.

The Online Responder's signing certificate could not be located.
  • Cause: The OCSP Response Signing certificate is not present in either the Personal certificate store for the computer account or, if the signing certificate should have been issued by using autoenrollment, autoenrollment was not completed.

  • Solution: If an OCSP Response Signing certificate is not present in the Personal certificate store for the local computer, and the revocation is configured for manual OCSP Response Signing certificate enrollment or auto-discovery, you should enroll for a certificate manually. For configurations in which the Online Responder service enrolls for its certificate, manual enrollment will not work and you need to identify the reason that autoenrollment did not work. Possible reasons include:

    • The computer on which the Online Responder service is running cannot connect to a certification authority (CA) that has been configured to issue certificates based on the OCSP Response Signing template.

    • The Online Responder does not have Read, Enroll, and, if autoenrollment is being used, Autoenroll permissions on the OCSP Response Signing template.

An attempt to create a revocation configuration failed.
  • Cause: An attempt to create a revocation configuration failed with the message "Bad signing certificate on Array Controller."

  • Solution: Verify that the OCSP Response Signing certificate template has been correctly configured. Otherwise, configure the certificate template to allow manual enrollment for these signing certificates.

The signing certificate for the Online Responder configuration will expire soon.
  • Cause: When autoenrollment is not being used, a reminder to renew an expiring certificate is generated automatically when a certificate has a configured percentage of its lifetime left (by default, this is 10 percent of its total validity period). You can check the time remaining on the current signing certificate by using the Certificates snap-in to examine the OCSP Response Signing certificate in the Personal certificate store of the computer or the Online Responder service.

  • Solution: If the OCSP Response Signing certificate template has been configured for automatic enrollment and renewal, further action may not be needed. For manual configurations, you can renew the signing certificate by using the Certificates snap-in and the Certificate Renewal Wizard.

The signing certificate for the revocation configuration has expired.
  • Cause: Automatic renewal of the signing certificate failed, or manual certificate renewal was not completed before the expiration date.

  • Solution: For configurations in which the Online Responder service enrolls for its certificate, manual enrollment will not work and you need to identify the reason that autoenrollment did not work. Possible reasons include:

    • The computer on which the Online Responder service is running cannot connect to a CA that has been configured to issue certificates based on the OCSP Response Signing template.

    • The Online Responder does not have Read, Enroll, and Autoenroll permissions on the OCSP Response Signing template.

    A CA administrator should use the Certification Authority and Certificate Templates snap-ins to verify the availability and configuration of the OCSP Response Signing template before autoenrollment can be tried again.

    If the revocation configuration is set up for manual enrollment of the OCSP Response Signing certificate, locate the signing certificate within the Online Responder computer's local computer Personal certificate store.

    For manual configurations, you can renew the signing certificate by using the Certificates snap-in and the Certificate Renewal Wizard.

    It is also possible that the OCSP Response Signing certificate could not be renewed because the CA key that was used to sign the original OCSP Response Signing certificate has been renewed and is no longer available. To overcome this problem, you must allow the OCSP Response Signing certificate to be renewed with an existing key. For more information, see Renew OCSP Response Signing Certificates with an Existing Key.

An Online Responder revocation configuration cannot be loaded.
  • Cause: The revocation configuration has become corrupted.

  • Solution: Use the Online Responder snap-in to delete and re-create the revocation configuration. If this problem occurred on an Array member, you can delete the corrupted configuration from the Array member and then synchronize the Array to re-create the revocation configuration. If you are encountering this problem on an Array controller, temporarily set another computer as the Array controller, synchronize the Array, and then reset the original computer to be the Array controller.

The Online Responder service could not retrieve a CRL for the specified revocation configuration.
  • Cause: Certificate revocation list (CRL) publication failed, CRL distribution points are invalid, or the Online Responder service could not access the published CRL.

  • Solution: To identify and address CRL retrieval problems for an Online Responder:

    1. Use the Online Responder snap-in to verify that the URLs configured for base and delta CRL distribution points are valid.

    2. Use the Certification Authority snap-in to verify the URLs to which the CA will publish base and delta CRLs.

    3. On the computer to which the base CRL is published, examine the Freshest CRL extension for the base CRL. Verify that this identifies a location where the delta CRL can be found.

    4. Republish the current CRL, if necessary, by typing the following command at a command prompt: certutil -crl

    5. Then, verify that Online Responder service can access the CRL. From the Online Responder snap-in, right-click Array Configuration, and click Refresh Revocation Data.


Revocation Providers

Online Responders in Windows Server 2008 R2 and Windows Server 2008 use the Microsoft certificate revocation list (CRL)-based revocation provider to provide certificate status. This revocation provider is the component that an Online Responder contacts to check the status of a certificate. The revocation provider is responsible for obtaining updated CRLs and determining the status of a certificate based on this CRL.

You can select one or more CRLs and delta CRLs for use with the Online Responders in your Array, and you can define how often the provider receives updated CRLs.


Implement Role-Based Administration

You can use role-based administration to organize certification authority (CA) administrators into separate, predefined CA roles, each with its own set of tasks. Roles are assigned by using each user's security settings. You assign a role to a user by assigning that user the specific security settings that are associated with the role. A user that has one type of permission, such as Manage CA permission, can perform specific CA tasks that a user with another type of permission, such as Issue and Manage Certificates permission, cannot perform.

The following table describes the roles, users, and groups that can be used to implement role-based administration. To assign a role to a user or group, you must assign the role's corresponding security permissions, group memberships, or user rights to the user or group. These security permissions, group memberships, and user rights are used to distinguish which users have which roles.

Roles and groups | Security permission | Description
CA administrator | Manage CA | Configure and maintain the CA. This is a CA role and includes the ability to assign all other CA roles and renew the CA certificate. These permissions are assigned by using the Certification Authority snap-in.
Certificate manager | Issue and Manage Certificates | Approve certificate enrollment and revocation requests. This is a CA role. This role is sometimes referred to as CA officer. These permissions are assigned by using the Certification Authority snap-in.
Backup operator | Back up file and directories Restore file and directories | Perform system backup and recovery. Backup is an operating system feature.
Auditor | Manage auditing and security log | Configure, view, and maintain audit logs. Auditing is an operating system feature. Auditor is an operating system role.
Enrollees | Read Enroll | Enrollees are clients who are authorized to request certificates from a CA. This is not a CA role.

All CA roles are assigned and modified by members of local Administrators, Enterprise Admins, or Domain Admins. On enterprise CAs, local administrators, enterprise administrators, and domain administrators are CA administrators by default. Only local administrators are CA administrators by default on a stand-alone CA. If a stand-alone CA is installed on a server that is joined to an Active Directory domain, domain administrators are also CA administrators.

The CA administrator and certificate manager roles can be assigned to Active Directory users or local users in the Security Accounts Manager (SAM) of the local computer, which is the local security account database. As a best practice, you should assign roles to group accounts instead of individual user accounts.

Only CA administrator, certificate manager, auditor, and backup operator are CA roles. The other users described in the table are relevant to role-based administration and should be understood before assigning CA roles.

Only CA administrators and certificate managers are assigned by using the Certification Authority snap-in. To change the permissions of a user or group, you must change the user's security permissions, group membership, or user rights.

To set CA administrator and certificate manager security permissions for a CA

  1. Open the Certification Authority snap-in.

  2. In the console tree, click the name of the CA.

  3. On the Action menu, click Properties.

  4. Click the Security tab, and specify the security permissions.

Roles and activities

Each CA role has a specific list of CA administration tasks associated with it. The following table lists all the CA administration tasks along with the roles in which they are performed.

Activity | CA administrator | Certificate manager | Auditor | Backup operator | Local administrator | Notes
Install CAs |  |  |  |  | X |
Configure policy and exit modules | X |  |  |  |  |
Stop and start the Active Directory Certificate Services (AD CS) service | X |  |  |  |  |
Configure extensions | X |  |  |  |  |
Configure roles | X |  |  |  |  |
Renew CA keys |  |  |  |  | X |
Define key recovery agents | X |  |  |  |  |
Configure certificate manager restrictions | X |  |  |  |  |
Delete a single row in the CA database | X |  |  |  |  |
Delete multiple rows in the CA database (bulk deletion) | X | X |  |  |  | The user must be both a CA administrator and a certificate manager. This activity cannot be performed when role separation is enforced.
Enable role separation |  |  |  |  | X |
Issue and approve certificates |  | X |  |  |  |
Deny certificates |  | X |  |  |  |
Revoke certificates |  | X |  |  |  |
Reactivate certificates that are placed on hold |  | X |  |  |  |
Renew certificates |  | X |  |  |  |
Enable, publish, or configure certificate revocation list (CRL) schedules | X |  |  |  |  |
Recover archived keys |  | X |  |  |  | Only a certificate manager can retrieve the encrypted key data structure from the CA database. The private key of a valid key recovery agent is required to decrypt the key data structure and generate a PKCS #12 file.
Configure audit parameters |  |  | X |  |  | By default, the local administrator holds the system audit user right.
Audit logs |  |  | X |  |  | By default, the local administrator holds the system audit user right.
Back up the system |  |  |  | X |  | By default, the local administrator holds the system backup user right.
Restore the system |  |  |  | X |  | By default, the local administrator holds the system backup user right.
Read the CA database | X | X | X | X |  | By default, the local administrator holds the system audit and system backup user rights.
Read CA configuration information | X | X | X | X |  | By default, the local administrator holds the system audit and system backup user rights.

Additional considerations

  • Enrollees are allowed to read CA properties and CRLs, and they can request certificates. On an enterprise CA, a user must have Read and Enroll permissions on the certificate template to request a certificate. CA administrators, certificate managers, auditors, and backup operators have implicit Read permissions.

  • An auditor holds the system audit user right.

  • A backup operator holds the system backup user right. In addition, the backup operator has the ability to start and stop the Active Directory Certificate Services (AD CS) service.

Assigning roles

The CA administrator for a CA assigns users to the separate roles of role-based administration by applying the security settings required by a role to the user's account. The CA administrator can assign a user to more than one role, but the CA is more secure when each user is assigned to only one role. When this delegation strategy is used, fewer CA tasks can be compromised if a user's account becomes compromised.

Administrator concerns

The default installation setting for a stand-alone CA is to have members of the local Administrators group as CA administrators. The default installation setting for an enterprise CA is to have members of the local Administrators, Enterprise Admins, and Domain Admins groups as CA administrators. To limit the power of any of these accounts, they should be removed from the CA administrator and certificate manager roles when all CA roles are assigned.

As a best practice, group accounts that have been assigned CA administrator or certificate manager roles should not be members of the local Administrators group. Also, CA roles should only be assigned to group accounts and not individual user accounts.

Note

Membership in the local Administrators group on the CA is required to renew a CA certificate. Members of this group can assume administrative authority over all other CA roles.


Revocation Configuration

Procedures are available to complete the following revocation management tasks:

  • Audit Revocation Configuration Changes

  • Manage Online Responder Security

  • Manage Revocation Data by Using Local CRLs

  • Delete a Revocation Configuration