This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 5%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELB%3C/text%3E%3C/svg%3E)
I am trying to debug why Windows does not accept the responses from my OCSP responder as valid. I am using the command
certutil -downloadocsp .\certs\ .\ocsp_responses\ downloadonce
A single p7b certificate is in the certs directory. I read the log of my OCSP responder in real-time, and I can see that
the connection is made. And the output from certutill looks like it downloads the responce. But certutil reports an
error, and no ocsp responce is saved in .\ocsp_responses\
The output from certutil is:
==== Downloaded OCSP Responses ====
7/5/2021 2:56 PM 44.368s :: Error => Pending OCSP response download -- <8958F37AF76E2151B548E950719789A1FA705F0A> <saratoga.candy-land.name> <ca-sub.candyland.org> <saratoga.candy-land.name_exchange_20210630145440_exchange.p7b>
Total: 1 Downloaded: 0 Warnings: 0 Pending: 1 Errors: 0 Maximum Thread Count: 2
CertUtil: -downloadOcsp command completed successfully.
I get the same behavior on Windows 10 Pro, and Windows Server 2019. The OCSP responder is openssl 1.1.1f
What might the problem be, and How can I correct it?
Looking again, the output message from certutil probably means
Pending: 1
not
1 Errors:
II discovered I can use the verbose option here. The verbose output is:
7/6/2021 2:43 PM 14.488s :: Check certificate files in directory <certs>
7/6/2021 2:43 PM 14.488s :: Open OCSP subject certificate file -- saratoga.candy-land.name_exchange_20210630145440_exchange.p7b
7/6/2021 2:43 PM 14.498s :: Add OCSP response file -- <8958F37AF76E2151B548E950719789A1FA705F0A> <saratoga.candy-land.name> <ca-sub.candyland.org> <saratoga.candy-land.name_exchange_20210630145440_exchange.p7b>
7/6/2021 2:43 PM 14.498s :: Waiting for 1 download OCSP reponses to complete
==== Downloaded OCSP Responses ====
7/6/2021 2:43 PM 14.498s :: Error => Pending OCSP response download -- <8958F37AF76E2151B548E950719789A1FA705F0A> <saratoga.candy-land.name> <ca-sub.candyland.org> <saratoga.candy-land.name_exchange_20210630145440_exchange.p7b>
Total: 1 Downloaded: 0 Warnings: 0 Pending: 1 Errors: 0 Maximum Thread Count: 2
CertUtil: -downloadOcsp command completed successfully.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 62%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDZ%3C/text%3E%3C/svg%3E)
Hello @List Box at name ,
How are things going on your end? Please keep me posted on this issue.
If you have any further questions or concerns about this question, please let us know.
I appreciate your time and efforts.
Best Regards,
Daisy Zhou
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Hello @List Box at name ,
I just want to confirm the current situations.
Please feel free to let us know if you need further assistance.
Best Regards,
Daisy Zhou
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Hello @List Box at name ,
Thank you for posting here.
To better understand your question, please confirm the following information at your convenience:
1.Based on the description above, you configured the OCSP responder through openssl 1.1.1f instead of on one Windows CA server, is it right?
2.Where did you run the command above (on one Windows server or Windows client)?
3.Does ocsp responce is a file? If so, why did not you copy the file to all these Windows machines manually?
I cannot see such command (certutil with parameter -downloadocsp) based on the certutil command usage.
certutil
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
Should you have any question or concern, please feel free to let us know.
Best Regards,
Daisy Zhou
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
1) Yes, the OCSP responder is openssl 1.1.1f, NOT Windows CA server,
2) I ran the certutil command on BOTH Windows Server 2019 and Windows 10 Pro, both had the same results.
3) No, OCSP responders use HTTP. The "downloadOcsp" verb in certutil coonnects via the AIA extension in the certificates found in the .\certs directory.
4) The downloadOcsp is documented in the certutil command itself. To see the documentation, you need to use
"CertUtil -v -?" and scroll back up to read the section on downloadOcsp. The text reads:
CertUtil [Options] -downloadOcsp CertificateDir OcspDir [ThreadCount] [Modifiers]
Download OCSP Responses and Write to Directory
CertificateDir -- directory of certificate, store and PFX files.
OcspDir -- directory to write OCSP responses.
ThreadCount -- optional maximum number of threads for concurrent downloading. Default is 10.
Modifiers -- Comma separated list of one or more of the following:
DownloadOnce -- Download once and exit
ReadOcsp -- Read from OcspDir instead of writing
By default, certutil won't exit and must be explicitly terminated.
Modifiers:
DownloadOnce
ReadOcsp
Hello @List Box at name ,
Thank you for your update.
Does it mean you need to approve the download request on openssl 1.1.1f manually?
Should you have any question or concern, please feel free to let us know.
Best Regards,
Daisy Zhou
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.