The Online Responder service does not return a deterministic GOOD for all certificates not included in the CRL

Step 1: Directory structure

1. Start Notepad, and then paste the following sample script into a new document:
   
   

   param(
       [ValidateScript({Test-Path $_})]
       [String] $Path
   )
   pushd $Path
   dir | foreach {
       remove-item $_ -force
   }
   certutil.exe -out serialnumber -restrict "Disposition = 20" -view | foreach {
       if($_ -match 'Serial Number: "([^"]+)"') {
           New-Item -type File $matches[1] | out-null
        } 
   }
   popd

2. Save the new document as Certs.ps1.

3. Create a directory in which empty files that correspond to all issued serial numbers are to be stored.

4. Run the Certs.ps1 script. To do this, run the following command in Windows PowerShell:
   
   

   Certs.ps1 <directory location created in step 3>

5. Examine the directory that you created in step 3 to make sure that the files correspond to the issued serial numbers.
   
   Note If you have multiple CAs hosted in your environment, make sure that their corresponding serial number directories are different. Do not share the same directory between different CAs.

6. Run the script on the CA computer, and upload the saved file by giving it restrictive ACLs. The file should not be editable. Make sure that all the Microsoft Online Responder computers can access this location.

Step 2: Registry

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1. Exit all Windows applications.

2. Click Start, click Run, type regedit, and then click OK.

3. Locate and then select the following registry subkey:
   
   

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OcspSvc\Responder

4. Click the certification authority (CA) for which you created the directory structure.

5. Right-click Provider Node, point to New, and then click Multi-String Value.

6. Type IssuedSerialNumbersDirectories, and then press Enter.

7. Right-click IssuedSerialNumbersDirectories, and then click Modify.

8. In the Value data box, type the path to the directory you created in step 3 of the directory structure procedure and that contains the issued serial numbers, and then click OK.
   
   For the directory path, use the following format:
   
   
   

   \\<computername>\<directorylocation>For example, use a path that resembles the following:
   
   
   

   \\contoso-ocspfileserver\SerialNumbers

9. On the File menu, click Exit to exit Registry Editor.

10. Install the hotfix package that is mentioned in this article.

After you follow the “Directory structure” and “Registry” steps, install the hotfix package that is mentioned in this article.

Results

After the hotfix is installed, the Online Responder service should do the following:

• Return a value of GOOD for the certificates that are verified

• Return a value of REVOKED for the certificates that are included in the CRL

• Return a value of UNKNOWN for all other certificates that cannot be verified

Prerequisites

To apply this hotfix, you must have Service Pack 1 for Windows 7 or Windows Server 2008 R2 installed.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any previously released hotfix.