OSCP failing on non domain joined stations externally with “responseStatus: unauthorized (6)” without ROOT CA and SUB certs

hi all,

i've been working through/struggling oscp setup enable rds our external users. think i'm on home stretch have 1 last hurdle in way, help!

my setup below …
root ca
  -- subordinate (intermediate) ca
        -- rds cert

i’ve been having issues when connecting rds externally error “checking the revocation list”

after various certutil –url tests found rds cert unsuccessfully externally non-domain joined stations. sniffed traffic , server responding “responsestatus: unauthorized (6)”

i tested sub cert successful.

i tested root ca returned no url, weird because see oscp url in ca certificate.

i check against domain join stations , non join stations (this solution home users) , found domain joined stations worked externally/internall non domain joined stations didn’t externally, or more point when ldap traffic blocked.
after various web searches , reading rfc 2560 wondered if non domain joined stations use oscp or if making more 1 request …

after little more investigation noticed had root ca cert in stations trusted root store not sub, once added work.

so question is, why need both root ca , sub in non domain joined stations oscp work, thought need root ca.

what have i missed?

thanks, john

hi,

if sub ca certificate not stored in local store , client computer fails download certificate aia url, certificate not able validated , cause issue.

please refer following article more information:

certificate revocation checking in windows vista , windows server 2008
http://technet.microsoft.com/en-us/library/ee619730(ws.10).aspx

hope helps.

 

---

please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread.

Windows Server  >  Security