Tag: Magic number

By default, Windows systems, even if an Online Responder (OCSP) is configured, will fall back to a certificate revocation list (if available) after a certain number of OCSP requests , because this is usually more efficient in such a case. However, this behavior is not always desired.

For example, if one uses smart card logons, one might want to know if logons were performed with certificates issued without authorization . In conjunction with the deterministic good of the Online Responder you can thus create an (almost) seamless audit trail for all smart card logons.

Continue reading "Force domain controllers (or other participants) to use an Online Responder (OCSP)"

Even if an Online Responder is present in the network and the certification authority has entered its address in the Authority Information Access (AIA) extension of the issued certificates, it is not always guaranteed that the Online Responder is actually used.

One variable here is the "Magic Number", which is present on every Windows operating system. It causes the system to fall back to certificate revocation lists (if present) if requests are made too often via OCSP for the same certification authority.

Continue reading "Configure the "Magic Number" for the Online Responder"

In the default configuration, the Online Responder returns the status "Good" for requested certificates that do not appear on one of the configured certificate revocation lists.

This can be problematic because the Online Responder has no knowledge of the certificates issued by the certification authorities. If an attacker succeeds in issuing a certificate with the private key of the certification authority without its knowledge, the Online Responder would not detect this, and the certificate would also show up as "Good" in the audit log .

Continue reading "Configure deterministic "Good" for the Online Responder (OCSP)"