Overview

This document guides security administrators through the procedure for installing, configuring and integrating Microsoft Online Certificate Status Protocol (OCSP) with a ProtectServer 3 HSM. Microsoft OCSP uses the ProtectServer 3 HSM to secure signing keys for OCSP operations. The Microsoft Online Responder service implements the OCSP by decoding revocation status requests for specific certificates. The service evaluates the status request for these certificates and sends back a signed response containing the requested certificate status information. The integration between ProtectServer 3 HSMs and OCSP uses the industry standard PKCS#11 interface to generate the identity keys and provide security by protecting the identity private keys within an HSM. The benefits of using ProtectServer 3 HSMs to generate the signing keys for OCSP are the following:

• Secure generation, storage, and protection of the private keys on FIPS-validated hardware.

• Full life-cycle management of the keys.

• Significant performance improvements by off-loading cryptographic operations from signing servers.

About the Microsoft Online Responder

The Microsoft OCSP implementation is separated into client and server components.

The client component is built into the Crypto API 2.0 library

Microsoft Online Responder Components after integration with ProtectServer 3 HSM