Could not retrieve an OCSP response.

Question

Could not retrieve an OCSP response.

Andreas 1,336

Hi,

We have 1 MS 2022 CA server, and have noticed on our DC`s the following error message

EventID 36928

Source Schannel

Could not retrieve an OCSP response.

   The Failure Reason is: REASON_OCSP_RESPONSE_RETRIEVAL_ERROR
    The OCSP Url is: 
   The previous OCSP response contained the following times:
      ThisUpdate: ‎1601‎-‎01‎-‎01T00:00:00.000000000Z
      NextUpdate: ‎1601‎-‎01‎-‎01T00:00:00.000000000Z

The attached data contains the certificate.

User's image

We don't have a OCSP installed, so why does this error message ? And as I understand we do not need any OCSP either. We only publish internal machine certificates so the machines can connect to the Wifi.

Please advice.

Thanks for any reply

/R

Andy

Olivier David 0 Reputation points

2025-06-27T13:30:54.1433333+00:00

Hi Andy,

I've got the same issue, and I wonder how you manage to get the certificate ?
In the event log I've got the very same error, but I don't know how to get the "attached data".
Regards,

Olivier
Damon Boyer 45 Reputation points

2026-08-07T15:57:49.9666667+00:00

Same issue - did some diging and it's smartscreen trying to reach http://oneocsp.microsoft.com

Damon Boyer 45

Log Name: microsoft-windows-CAPI2/Operational

Source: Microsoft-Windows-CAPI2

Date: 8/7/2026 11:35:23 AM

Event ID: 53

Task Category: Retrieve Object from Network

Level: Information

Keywords: Automatic Root Update,Retrieval,Revocation,Path Discovery

User: <DOM\USER>

Computer: <SERVER>.<DOMAIN>

Description:

For more details for this event, please refer to the "Details" section

Event Xml:

<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />

<EventID>53</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>53</Task>

<Opcode>2</Opcode>

<Keywords>0x4000000000000036</Keywords>

<TimeCreated SystemTime="2026-08-07T15:35:23.3660423Z" />

<EventRecordID>52</EventRecordID>

<Correlation ActivityID="{00cc000c-0006-0000-2423-ac285022cc48}" />

<Execution ProcessID="8996" ThreadID="7520" />

<Channel>microsoft-windows-CAPI2/Operational</Channel>

<Computer><SERVER>.<DOMAIN></Computer>

<Security UserID="<USERGUID>" />
  </System>

  <UserData>

xml
<CryptRetrieveObjectByUrlWire>

  <URL scheme="http">http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D</URL>

  <Object type="CONTEXT_OID_OCSP_RESP" constant="6" />

  <Timeout>PT15S</Timeout>

  <Flags value="202004" CRYPT_WIRE_ONLY_RETRIEVAL="true" CRYPT_LDAP_SCOPE_BASE_ONLY_RETRIEVAL="true" CRYPT_PROXY_CACHE_RETRIEVAL="true" />

  <AuxInfo maxUrlRetrievalByteCount="104857600" cacheFileNamePrefix="B76BE66D46C355931939D8CF818D03FD_" fProxyCacheRetrieval="true" />

  <AdditionalInfo>

    <NetworkConnectivityStatus value="1" _SENSAPI_NETWORK_ALIVE_LAN="true" />

    <HTTPRequestHeadersInfo>

      <Header>GET /ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D HTTP/1.1</Header>

      <Header>Accept: */*</Header>

      <Header>User-Agent: Microsoft-CryptoAPI/10.0</Header>

      <Header>Connection: Keep-Alive</Header>

    </HTTPRequestHeadersInfo>

    <HTTPResponseHeadersInfo>

      <Header>HTTP/1.1 200 OK</Header>

      <Header>Cache-Control: max-age=300</Header>

      <Header>Date: Fri, 07 Aug 2026 15:37:44 GMT</Header>

      <Header>Content-Length: 1761</Header>

      <Header>Content-Type: application/ocsp-response</Header>

      <Header>Last-Modified: Wed, 05 Aug 2026 19:55:14 GMT</Header>

      <Header>ETag: bff0ea1a-9dd7-404b-8cde-a16d1732bb3c</Header>

      <Header>X-Cache: TCP_HIT</Header>

      <Header>Responder: DigiCert-http://msocsp.edge.digicert.com/</Header>

      <Header>X-MSEdge-Ref: Ref A: 98E2B629856147DD9E2B9698652D003D Ref B: MIAEDGE2517 Ref C: 2026-08-07T15:37:44Z</Header>

    </HTTPResponseHeadersInfo>

  </AdditionalInfo>

  <CacheInfo lastSyncTime="2026-08-07T15:35:23.349Z">

    <URLCacheResponseInfo responseType="CRYPTNET_URL_CACHE_RESPONSE_HTTP" lastModifiedTime="2026-08-05T19:55:14Z" maxAge="300" />

  </CacheInfo>

  <RetrievedObjects>

    <OCSPResponse fileRef="9C7028B8B9B4C8A7680C899D67C480A6D9389341.bin" />

  </RetrievedObjects>

  <EventAuxInfo ProcessName="smartscreen.exe" />

  <CorrelationAuxInfo TaskId="{CD2FF212-CBDE-4F24-8EB4-82B4A6730078}" SeqNumber="12" />

  <Result value="0" />

</CryptRetrieveObjectByUrlWire>
  </UserData>

</Event>

8 answers

Your answer

Olivier David 0 Reputation points

2025-06-27T13:30:54.1433333+00:00

Hi Andy,

I've got the same issue, and I wonder how you manage to get the certificate ?
In the event log I've got the very same error, but I don't know how to get the "attached data".
Regards,

Olivier
Damon Boyer 45 Reputation points

2026-08-07T15:57:49.9666667+00:00

Same issue - did some diging and it's smartscreen trying to reach http://oneocsp.microsoft.com

Answer 1

Hi All

Did anyone come up with a solution for this? I have just expereinced the same issue after upgrading one of our DCs from Server 2019 to Server 2022. We are running an Enterprise CA for internal purposes only and was of the understanding OCSP is to check public based certificates.

Prior to the upgrade we ran a full DCDIAG across our estate (all DCs on Server 2019) and had Zero issues. Now when running a DCDIAG on the upgraded DC the exact same issue is occurring as Andreas initially reported.

Has anyone tried adding the OCSP Responder to their CA and if so did this fix it? Although I dont understand as under the CA Extensions Tab you add a public address which wouldnt address any self signed certificates?

We removed any ldap entries from the CA Extensions Tab, we had no OCSP entries and the warnings remained so reinstated the ldap addresses.

Thanks in advance!

Answer 2

I was using an OCSP responder and got this error on a newly built DC running Server 2022.

Any other server or workstation on the domain I tested could validate certs fine against the OCSP server.

To replicate the error export a cert. Can be any cert as long as it is issued from your CA.

Run this certutil test. In this case I call my exported cert dc.cer.

certutil -f –urlfetch -verify .\dc.cer | sls "OCSP"

The OCSP call will fail from the server generating these event log entries but the same command will work from another host.

I can't say I worked out why this happens but I got around it by restarting the OCSP server. Then running the same command on the new DC worked

Answer 3

Maurizio Poles 0

I am having the same issue with Windows Server 2022. However, this started to happen after I installed the CA. All the settings are default. I have not modified any settings. In the past, I never had this issue with just defaulted settings. What do I need to do to resolve this?

0 comments

Answer 4

Parham, Joseph 5

Check the configuration of CA. The notes state you have one 2022 CA so you have a root that is also acting as the policy and issuance CA as well. Remote to the CA itself, open Certificate Authorities console under Windows Administrative Tools. Right click the CA and select Properties. Click the Extensions tab. In the selections box choose Authority Information Access (AIA). This is where the validation of the CA is defined. What is located there is encoded on all certificates issued from the CA. If you find LDAP entries and/or OCSP entries then the problem is you are encoding certs with that validation information but the validation end points don't exist. LDAP validation is the old way and is listed for support of 2003 and older OS. The URLs listed on this tab should exist or not be listed. They are populated when the CA was initially configured. You should have at least one location (local drive) and one CDP location (AIA entry) at minimum. Remove the LDAP and OCSP locations which don't exist.

Ludovic Mascolo 5 Reputation points

2023-05-31T14:01:01.5133333+00:00

Can you please provide an argument for this fact : "LDAP validation is the old way and is listed for support of 2003 and older OS."?
I couldn't find any official reference for this point.

Thank you.
Tarek-Rasheed AbdElmgeed Mostafa Zenbaa 116 Reputation points

2023-05-31T15:37:04.78+00:00

Thank you all

Answer 5

Jose Wilson Da Conceicao Junior 0

I got the same issue on my secondary DC with Windows 2022 Std. I have a CA deployed but I do not have a configuration revocation on my Online Responder.

Any suggestions?

Thanks!

0 comments