IIS hardening for OCSP

Question

Hello

we are providing OCSP (Microsoft) services which run on IIS.

In the process of hardening IIS the following findings have surfaced. May I ask for your input since the Internet does not provide any information:

• Ensure global .Net trust level is configured

Does OSCP utilize .Net? Which .Net trust level is needed

• Ensure unlisted file extensions are not allowed

Which file extensions does OCSP need to be allowed in IIS?

Any help is highly appreciated

Thanks a lot

Answer 1

Hello

Here are some links about deploying Windows OCSP.

However, it does not mentioned IIS features OCSP requires.

Implementing an OCSP responder: Part I - Introducing OCSP | Microsoft Community Hub

Implementing an OCSP responder: Part II - Preparing Certificate Authorities | Microsoft Community Hub

Implementing an OCSP responder: Part III - Configuring OCSP for use with Enterprise CAs | Microsoft Community Hub

Implementing an OCSP responder: Part IV - Configuring OCSP for use with Standalone CAs | Microsoft Community Hub

Implementing an OCSP Responder: Part VI Configuring Custom OCSP URIs via Group Policy | Microsoft Community Hub

And here is a third-part link about how to install and configure OCSP.

Install and configure an OCSP responder to manage certificate revocation on Windows Server 2016 - Windows Server - Tutorials - InformatiWeb Pro (informatiweb-pro.net)

Based on my knowledge, i should install IIS on the server when I install and configure CA and OCSP.

Best Regards,
Daisy Zhou

Answer 2

Hello Sabine Ludewig,

Thank you for posting in Microsoft Community forum.

From the description above, I understand your question is related to IIS.

Since there are no engineers dedicated to IIS in this forum. in order to be able to get a quick and effective handling of your issue, I recommend that you repost your question in the Q&A forum, where there will be a dedicated engineer to give you a professional and effective reply.

Here is the link for Q&A forum.
Questions - Microsoft Q&A

Click the "Ask a Question" button in the upper right corner to post your question and type "Internet Information Services" tag and select any tags related to your productions.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 3

Hello Daisy

my question is not particulary about IIS.

It's about about which IIS features OCSP requires (.Net trust level, allowed file extensions).

Thanks