Strange OCSP response by the Online Responder

Hi,
When I run certutil -verify -urlfetch on two different certificates that are issued by the same Issuing CA, the response is quite different and that raised my concern for the Online responder not working as it should. Here is the two outputs..
Output nr1.
CRL (null):
Issuer: CN=Server FQDN
ThisUpdate: 2015-04-14 21:05
NextUpdate: 2015-04-22 09:25
39c5508bc895eef3e97d8b611d1fa1fc17d3db19
Issuance[0] = 1.2.752.113.10.1.1.1.1 VGC-PKI CPS
Application[0] = 1.3.6.1.5.5.7.3.2 Client Authentication
Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication
Output nr2.
CRL 323e:
Issuer: CN=CA Logical name
ThisUpdate: 2015-04-14 22:05
NextUpdate: 2015-04-22 10:25
222195864225835a025a52015d5dca5fc2c71f30
Issuance[0] = 1.2.752.113.10.1.1.1.1 VGC-PKI CPS
Application[0] = 1.3.6.1.4.1.311.54.1.2 Remote Desktop Authentication
Why is the first output missing CRL number and why does it produce a response with the server FQDN and not the CA logical name?
By the way, we are running 2012 R2 on the and Online Responder.
Please help me understand.
Kind regards
Mikael

Hi Mark
Thanks for the help. Here is the response that Mark gave.
Mikaels question:
Hi Mark,
Please, look through them and see if there is any clue in them to my issue. To be honest, I don’t know if it is really a problem or not with the Online Responder.
When I produced the two outputs I started first with running certutil –verify –urlfetch against the certificate for vgwb0195 and then I moved on to the certificate for vgts0034.
Like you can see in the output the first certificate vgwb0195, has no CRL version number and the Issuer is the FQDN of the OSCP responder. The second certificate vgts0034 has a CRL version number and the CA name In the Issuer field.
When I later run the Certutil –urlcache * delete to clear my cache and do the opposite order then vgwb0195 Is the one that has CRL version number and and the CA name as the Issuer.
Can you explain? Is it a bug?
Marks answer:
This is normal, you are just seeing the effects of the local caching mechanism. Also, delete the urlcache is ineffective and was replaced many years ago with this syntax:

Similar Messages

Add revocation info (ocsp response) in the signatures

I'm doing an application to sign pdfs in java.
I already have successfully sign pdfs, but I want to add also the revocation info embedded into the file. I have no problems with CRLs, but I can't add the other revocation method like a ocsp response.
To get a fully signed pdf I have downloaded adobe pro 9 trial version, and I'm trying to sign a pdf with revocation info. For that I selected the "add revocation info when signing" in security preferences. So I sign a pdf with revocation info activated and another one without it. Comparing both files there is a file size difference of 300 KB, so I suppose something has added. But when I validate the pdf with the adobe reader I can't get a valid signature in offline mode. Really I'm not sure if the acrobat reader don't understands correctly the revocation info embedded in the pdf or if the signature itself is not correct.
If I use my program to sign the pdf and I add the crls the acrobat reader validate correctly the signature in offline mode.
Anyone have manage to sign a pdf with adobe pro 9 including revocation info? or anyone know where I cat get a sample pdf with an ocsp response embedded? or anyone knows something to help me?
thanks.

Hola Alfredo,
"So if I trust directly in the ocsp responder it would be a valid ocsp response, right?"
Wrong. Although nothing happens in Acrobat without trust being established, it's not enough to just assign a certificate in the chain "trust anchor" status. All of the other rules must be followed as well. As an example, although we have been discussing OCSP responses, similar rules apply to indirect CRLs. If a CA is using an indirect CRL the correct extensions in both the CRL itself and the certificate under test would need to be present. It wouldn't be enough to just trust the signer of the CRL.
"Is there any possibility in adobe to trust in the responder, the same way as I can do with the timestamp?"
It's a little more complicated than that, but Acrobat does allow for a user to establish local trust in accordance with RFC 2560, Section 4.2.2.2. You are asking about adding "a local configuration of OCSP signing authority for the certificate in question". It can be done using the registry keys defined in the Acrobat Security Administration Guide (location noted in the first reply above), Section 5.4.1.1. You need to define the iURLToConsult and the sURL (which tells Acrobat to accept any OCSP response that comes from this URL). That's the effect you are looking for. However, these are global settings and will overwrite any other certificates, so you might want to set up a Custom Cert Preference as described in Section 3.4.6.
"Adobe have any type of utility or log to show more details about the signature verification?"
Yes, check out section 5.4.4.4 of the Acrobat Security Administration Guide.
"In that last case with the nextUpdate problem it were not giving me any type of error about the ocsp, but anyway It didn't consider valid the response as you say."
With apologies, I wasn't clear enough on this issue. It's not that Acrobat doesn't consider the response valid, but rather it's doesn't consider the response usable for other than "real time" usage. An OCSP response downloaded in real time that doesn't contain the nextUpdate extension is valid (assuming all other checks are okay). It's only when you are trying to use a cached OCSP response without the nextUpdate extension that Acrobat won't accept it. The lack of the nextUpdate extension is a tool that the CAs have at their disposal to force requesting applications (in this case Acrobat) to always ask for the latest information and not rely on older data.
"And the last question, where can I get a sample pdf with an embedded valid ocsp response? do you have any sample one?"
The Acrobat Security Administration Guide has an embedded OCSP response covering the end-entity in the signing chain.
Steve

OCSP response processing

I am one of thousands of Acrobat users in a US Federal Agency. I am introducing digital signatures using smart card credentials (FIPS-201 PIV card) on a Windows 7 machine using Acrobat to add the signature field to an existing Form.
We need to embed the signature verification information in the Form. The CRL embeds and adds 3MB to the 240KB document size. The second signature adds another 3MB. This is unsustainable and we need to use OCSP for certificate revocation checking and embed the OCSP Response into the form. We are trying to determine why Acrobat is not using the OCSP response. The CRL cache is cleared and the signature applied. The OCSP Response is apparently ignored or fails some part of Acrobat processing. I did find a previous note ( http://forums.adobe.com/message/2752534 ) that indicates that
"...If OCSP response signing certificate contains CRL distribution point (in my case CDP (CRL) and AIA (OCSP)), online OCSP check executes, but after getting all chain certificate OCSP responses, validating signature against CRL (it’s looks from Local cache). It means you never get OCSP validation data in Adobe Acrobat or Reader signature revocation tab..."
From the PKI Shared Service Provider I rec'd the following:
"...when we generated the OCSP signing cert that it populated the CDP and OCSP info in the AIA which it was not supposed to. So it looks like the combination of the Adobe problem mentioned in the article and the issue with the OCSP signing cert may be causing it to ignore the OCSP info and to continue on to process the CRL."
Can you confirm that Acrobat will fail to use the OCSP Response in our case?
Can you offer a work-around for the issue?
Thanks and regards, Dave

This issue was put into Adobe support. They have identified it as a bug in crl/ocsp
processing and have escalated it into engineering. There is no estimate of when the
bug will be fixed.

Enable Multiple Stapled OCSP Responses in IIS

I would like to configure IIS to send multiple stapled OCSP responses when sending its certificate chain to a web client at the start of an SSL/TLS connection. Currently, IIS only sends the OCSP response (signed indication from the issuing CA
that the certificate is still valid and not revoked) for the server certificate, but doesn't send it for the intermediate certificates.
For instance, if my IIS web server certificate is issued by the Entrust CA, it may be signed by the Entrust intermediate certificate "Entrust L1C", which is then signed by the Entrust root CA certificate "Entrust 2048". In that
circumstance, IIS is only sending the client the OCSP status for the server certificate, but not the OCSP validation status for the "Entrust L1C" certificate. So, the web client doesn't have to currently do an OCSP query to the Entrust
CA for the server certificate (since the web server sends that OCSP response to the web client), but does have to do an OCSP query to the Entrust CA for "Entrust L1C" to verify the intermediate certificate also isn't revoked. If the web client
is behind a tight firewall that doesn't allow browsing to random Internet IPs for OCSP, the web client is unable to know if the certificate is still valid. The response from the IIS forum http://forums.iis.net/post/2097704.aspx was that
I should post the question here.
How can I configure IIS to send OCSP responses (OCSP stapling) to web clients for the intermediate certificates in its certificate's chain as well? Multiple Certificate Status Request Extension is an Internet standard documented in RFC 6961 at
http://tools.ietf.org/html/rfc6961. Is there a way to configure IIS to do this?

It is working as designed. Currently OCSP Stapling only includes the revocation status for the leaf/server certificate. The assumption is that the offline CA certificates use CRLs, the CRLs are cached and should not need to be included in the stapled responses.
Brian

My iCal won't go online and returns the error message: The server responded with "500" to operation CalDAVAccountRefreshQueueableOperation.

My iCal won't go online and returns the error message: "The server responded with “500” to operation CalDAVAccountRefreshQueueableOperation."

OK Now I can answer my own question. The incomprehensible (inexcusably geeky) error message is actually Apple language for saying simply: "The iCloud servers are down again. Please wait until we've fixed them." I found this out by talking to Apple support. It took about 12 hours for the iCloud server synching calendars to come back online. When they did, my calendar reloaded, and everything was fine.

TS3999 calandar on my macpro says its off an when I try to take it online I get this message: The request for account "iCloud" failed. The server responded with "507" to operation CalDAVAddCalendarQueueableOperation.

My calandar on mac pro isn't online, when I try to take it online it says:
The request for account “iCloud” failed.
The server responded with
“507”
to operation CalDAVAddCalendarQueueableOperation.
How do I fix it? It's not syncing with my phone or ipad or icloud online. Thanks

In System Preferences>iCloud, click the account button, log off then back on.

OCSP response signature is invalid--ALC-DSS-111-005

Hi All,
I am using "verify pdf signature" process for signature verification for pdf having signed signature field.
I am getting an error in status message of pdfSignatureVerificationResult as "ALC-DSS-111-005--OCSP response signature is invalid".
Kindly provide any information to resolve this issue.
Regards
Abhishek

The OCSP protocol has an option for accepting only signed requests, where the signer of the OCSP request has to be trusted by the OCSP Responder.
LiveCycle Digital Signatures ES2 and or Acrobat can be configured to sign OCSP requests.
In LiveCycle, it is part of the Digital Signatures service configuration, see attached screen shots. Acrobat\Reader supports it through a registry entry... I have attached the relevant page from the Digital Signatures and Document Security administration guide.
Regards
Steve

Windows Server 2012 R2 Certificate Services - Online Responder DNS Alias

I am setting up a 2012 R2 PKI. Going with an offline standalone Root with an enterprise issuing CA. This is how I'd like to configure OSCP if possible & supported.
Build an OSCP array. Members will be in different sites. One in each office, one in the data center, and one in the DR data center. They will all be online 24x7. Host names are oscp1.company.com, oscp2.company.com, etc.
I want to create four A records in DNS for OSCP.company.com. One with each host's IP address.
The reason behind this is setting up the AIA extension. If I need to add a new online responder, I don't want to have to re-issue certificates so everyone can use it.
Will this work?

definitely, you can create A records with desired name as many as you need and use single "ocsp.company.com" URL in the AIA extension. This will work unless DNS resolves this URL to a OCSP service. In this scenario you may consider to configure "Netmask
ordering" in DNS properties, so DNS will return the nearest OCSP server IP address.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new:
SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

NextUpdate, embedding OCSP response

Hi,
I am trying to understand revocation info and relevant processes in the PDF signature...
"If nextUpdate is not set, the responder is indicating that newer revocation information is available all the time".
I have a situation where my OCSP response doesn't have nextUpdate set. This means that Reader should always
check whether certificate is revoked or not, right ?
Here is what I do right now:
1) include signing certificate and PKCS#12 cert chain(my digital id for OCSP) in PDF signature appearance
2) sign PDF byterange on SmartCard and set external digest on PKCS7
3) include OCSP response in PKCS7
QUESTION 1:
But for some reason I don't see that OCSP is embedded in PDF any way. Although I see it exists in Byterange content.
Any explanation ?
I have 2 signing certificates which I can use in step #1. Their intended usage:
1) Sign transaction, Encrypt keys, Encrypt document, Client Authentication, Email Protection
2) Sign document
Here is the revocation info that is shown on Revocation Info Tab:
1) ... The selected certificate is considered valid because it does not appear in a Certificate Revocation List (CRL).
2) ... No revocation checks are done for such certificates, they are inherently considered trustworthy.
QUESTION 2:
Can't I use certificate #2 for embedding OCSP in PDF ?

I am currently reading "Long-Term Digital Signatures" that states: "Revocation responses from an OCSP server are usually time stamped by the server that creates them". What does time stamped mean in the thisUpdate/nextUpdate context?
p.s. The topic I raised is based on custom solution that signs PDF using iTextSharp. I am embedding OCSP response myself, how does Reader behaves when there is no nextUpdate entry ?
Regards,
M.

How would one test the system response of the following example control loop

Basically, I want to control the upstream pressure in a pipe, using a single setpoint PID loop on a valve. As the pressure changes up or down, upstream, I want to open or close a valve appropriately to maintain say 5kpsi.
I will used the advanced auotune PID loop, My instrument provides a 4-20mA, and my valve accepts a 4-20mA signal.
Would I be able to simulate this without taking the equipment to a live system? I have a simulated 4-20mA that I could inject into the DAQ and increase/decrease as required to simulate pressure changes, and the DAQ could give a 4-20mA signal to the valve.
But how would this all work in practice. Id like to see the valve respond, but unsure how I would be able to verify the valve response and upstream pressure
Any ideas or tips?

You should be able to simulate without equipment to get the PID response you are looking for. The best place to state would be the LabVIEW example programs. Use Help -> Find Example and search for PID. I used this one to get the PID response I was looking for: C:\Program Files\National Instruments\LabVIEW 2011\examples\control\PID\Autotuning PID Online.vi
SOme systems respond quickly and others much slower. Some systems can't deal with overshot and there are many design considerations. You will need to tune the PID look for what is best for your system.If the system is straight forward and you can apply "rules" then consider the Fuzzy Logic controller. I have had success with both but there is no magic answer for PID loops except trial and error.
Matthew Fitzsimons
Certified LabVIEW Architect
LabVIEW 6.1 ... 2013, LVOOP, GOOP, TestStand, DAQ, and Vison

SAP GoLive : File System Response Times and Online Redologs design

Hello,
A SAP Going Live Verification session has just been performed on our SAP Production environnement.
SAP ECC6
Oracle 10.2.0.2
Solaris 10
As usual, we received database configuration instructions, but I'm a little bit skeptical about two of them :
1/
We have been told that our file system read response times "do not meet the standard requirements"
The following datafile has ben considered having a too high average read time per block.
File name -Blocks read - Avg. read time (ms) -Total read time per datafile (ms)
/oracle/PMA/sapdata5/sr3700_10/sr3700.data10 67534 23 1553282
I'm surprised that an average read time of 23ms is considered a high value. What are exactly those "standard requirements" ?
2/
We have been asked to increase the size of the online redo logs which are already quite large (54Mb).
Actually we have BW loading that generates "Chekpoint not comlete" message every night.
I've read in sap note 79341 that :
"The disadvantage of big redo log files is the lower checkpoint frequency and the longer time Oracle needs for an instance recovery."
Frankly, I have problems undertanding this sentence.
Frequent checkpoints means more redo log file switches, means more archive redo log files generated. right ?
But how is it that frequent chekpoints should decrease the time necessary for recovery ?
Thank you.
Any useful help would be appreciated.

Hello
>> I'm surprised that an average read time of 23ms is considered a high value. What are exactly those "standard requirements" ?
The recommended ("standard") values are published at the end of sapnote #322896.
23 ms seems really a little bit high to me - for example we have round about 4 to 6 ms on our productive system (with SAN storage).
>> Frequent checkpoints means more redo log file switches, means more archive redo log files generated. right?
Correct.
>> But how is it that frequent chekpoints should decrease the time necessary for recovery ?
A checkpoint is occured on every logswitch (of the online redologfiles). On a checkpoint event the following 3 things are happening in an oracle database:
Every dirty block in the buffer cache is written down to the datafiles
The latest SCN is written (updated) into the datafile header
The latest SCN is also written to the controlfiles
If your redologfiles are larger ... checkpoints are not happening so often and in this case the dirty buffers are not written down to the datafiles (in the case of no free space in the buffer cache is needed). So if your instance crashes you need to apply more redologs to the datafiles to be in a consistent state (roll forward). If you have smaller redologfiles more log switches are occured and so the SCNs in the data file headers (and the corresponding data) are closer to the newest SCN -> ergo the recovery is faster.
But this concept does not really fit the reality because of oracle implements some algorithm to reduce the workload for the DBWR in the case of a checkpoint.
There are also several parameters (depends on the oracle version) which control that a required recovery time is kept. (for example FAST_START_MTTR_TARGET)
Regards
Stefan

When I try entering a new event in iCal on my MacBook Air, I get an error message popping up on my screen that says: The request for account "iCloud" failed. The server responded with "502" to operation CalDAVSetPropertyQueueableOperation. Help!!??

When I try entering a new event in iCal on my MacBook Air, I get an error message popping up on my screen that says:
The server responded with “502”
The request for account “iCloud” failed.
The server responded with “502” to operation CalDAVSetPropertyQueueableOperation.
The request for account “iCloud” failed.
I am then given the option of staying Online or going Offline.
Can anyone help me?
thanks

Hello b.krushel,
Thank you for using Apple Support Communities
Any number of things could cause this issue, so I would recommend this article named iCloud: Troubleshooting iCloud Calendar found here http://support.apple.com/kb/TS3999.
These sections in particular:
General Troubleshooting
Make sure there are no current issues listed on the System Status that affect iCloud Calendar. The System Status is located on the iCloud Support webpage.
Make sure you have fully enabled iCloud Calendar for the client you are using (for more setup and troubleshooting information on iOS, OS X, Windows and iCloud.com, see the additional details below).
Check to see if the issue you are seeing is covered in iCloud Help. To search iCloud Help, visit help.apple.com/icloud.
Check your settings and preferences as something may not be set up correctly. For example, having incorrect date and time settings can cause issues which are easily resolved by entering the appropriate settings.
Troubleshooting Calendar on OS X Mountain Lion (iCal on OS X Lion)Note: For instructions on setting up iCloud Calendar with Calendar or iCal on your Mac, see iCloud Setup.If you are having trouble with Calendar or iCal on a Mac and you are using iCloud Calendar, try each of these steps, testing after each to see if the issue is resolved:
Make sure you are using OS X Lion v10.7.2 or later. Click here for help verifying the version of OS X you are using.
Make sure your computer is online. Attempt to view www.apple.com and iCloud.com. If you can't connect to the Internet, your iCloud calendars and events will not update in iCal. Click here for more information about troubleshooting your Internet connection.
Verify that your iCloud member name is entered into the iCloud Preference pane in System Preferences. See iCloud Setup for more information about setting up iCloud on a Mac.
Make sure you enter and update calendar information in the iCloud section of Calendar or iCal. Only calendars and events in the iCloud section of the Calendar or iCal Calendar list will be pushed to iCloud. Both Calendar and iCal for the Mac support the display of and interaction with multiple accounts and datastores, for example, iCloud, On My Mac, Exchange, Google, and so on. This makes it easy to create or modify events or calendars in a section of Calendar or iCal that may not be updating iCloud. Learn more about moving local calendars to iCloud.
In some cases, you may find that you have data duplicated in both the local On My Mac and the iCloud sections of Calendar or iCal. Learn more about resolving this issue.
You can make the iCloud calendar your default calendar for all new events. In Calendar on OS X Mountain Lion, choose Calendar > Preferences > General, or in OS X Lion, choose iCal > Preferences > Generaland under the Default Calendar heading, select one of the Calendars under the iCloud heading. Close the Preferences window to save this change.
If recent changes simply don't appear, try forcing Calendar or iCal to refresh by selecting Refresh All from theCalendar menu.
Make sure your account was successfully created in Calendar on your Mac (or iCal). After upgrading to iCloud Calendar, you may need to quit and reopen Calendar (or iCal). To confirm your account is configured correctly in iCal:
Open Calendar (or iCal).
Open Calendar (or iCal) Preferences.
Click Accounts. You should see an account with your iCloud member name entered.
Turn iCloud Calendars off and back on
Quit Calendar (or iCal).
Choose Apple () menu > System Preferences > iCloud.
Remove the checkmark in the checkbox next to Calendars.
Close System Preferences and wait about a minute.
Open System Preferences and choose iCloud.
Replace the checkmark next to Calendars.
Close System Preferences.
Open Calendar (or iCal) and test to see if the issue has been resolved.
Restart your computer. This may sound simple, but it does reinitialize your network and application settings and can frequently resolve issues.
Take care,
Sterling

The request for account "iCloud" failed. The server responded with "400" to operation CalDAVAddSubscriptionCalendarQueueableOperation

Does anyone know how to fix this problem? Or even what the problem is? I am trying to subscribe to a calendar and every time I do, it gives me this response:
The request for account “iCloud” failed.
The server responded with
“400”
to operation CalDAVAddSubscriptionCalendarQueueableOperation
Any help would be fantastic. This is a course calendar, and I really need it.
Thank you!

Keep away from iCloud and keep away from iCal. This is the most reliable solution to these 403 issues.
The Mac cannot upload calendars and keeps popping up error messages with an insane frequency.

Can't get any response from the Tuner - is it broken?

I'm happily chugging away through my new David Nahmani tutorials and I've discovered that I can get no response from the Tuner. The controls in the window appear to be working, but no line appears in the meter and flat lines appear in the center for pitch and octave. The channel strip indicates normal sound input and variation. I don't have any trouble recording (so far anyway). Is there anything I'm not aware of that could cause this?

Thanks for the reply, Rob. I'm just trying to tune a wind instrument through the built-in mic on my MacBook Pro, but I discovered the answer not too long after submitting the question. As I said, I'm trying to work through the Nahmani Logic Pro and Logic Express 8 book. I've been trying to be very meticulous about the installation and the setup for the tutorials, but I guess I inadvertently made settings changes that interfered with the Tuner, because choosing Logic Express > Preferences > Initialize All Except Key Commands allowed the Tuner to work the way I expected. I assumed the problem must have been bus related after I saw the Tuner respond to internal playback after modifying some bus settings, so I executed that command and all was well (uh, I should probably change that to "most was well", but at least the Tuner is working now). Thanks again.

How to find the Actual Responder Name Displayed in a Notification

Hi,
Where are the details of the Actual Responder Details stored in the case of the below scenario
If a notification for one user was closed by another user through access to the first user's worklist, the name of the second user, who actually took the action, is displayed as the responder.
I am only able to find the Original Recipeint username in the wf_notifications table.
But where will the details of the Actual Responder name displayed in the notification be stored.
When I use the "wf_notification.Responder" function, I get the Original Recipeint username of the user but not the one who acted on the notification. Is there ANY way by which I can get the Actual responder user name who acted on the notification
select responder from wf_notifications where notification_id = <nid> also gives me the Original Recipeint username of the user but not the one who acted on the notification
Please help.
Regards,
Kalyan

Hi Alejandro,
Thanks for the response.
Both the RESPONDER and the ORIGINAL_RECIPIENT Column show the same username.
The User who is approving the Notifications is having the access to the Worklist of the Original User through proxy.
He is the proxy of the Original User.
I think WF_ENGINE.context_proxy will store the actual user name who responds to the notification. But where does this actually store , i am not able to get.
We Need to find out the both the user names (one who received the notification , and the one who has approved it (in our case it is the user who has been set as a proxy and has access to the original user's work list) for the closed notifications.
In the Work flow Notification , it shows both the Original Recipeint and also the Actual Responder Name.
Regards,
Kalyan

Strange OCSP response by the Online Responder

Similar Messages

Maybe you are looking for