OCSP Responder implementation - is the default website required?

hello,
 i'm implementing 2 tier pki hierarchy , have few questions regarding ocsp.

firstly, have issue whereby can't install ocsp default website on iis server has been removed , custom site has been added.according link below, can add ocsp virtual directory, i'm not sure - article mentions using own custom virtual directory, installation\configuration wizard creates ocsp virtual application - supposed create custom virtual application around this?

 do need set ocsp values on root ca? specifically, need include ocsp extension in aia location root ca? far, i've checked value on enterprise sub ca.

 in addition, examples i've seen show ocsp configuration using single ca, have multiple cas, how can configure ocsp handle multiple cas?

 http://social.technet.microsoft.com/wiki/contents/articles/13767.attempt-to-configure-online-responder-failed-with-error-code-0x80070002-the-system-cannot-find-the-file-specified.aspx

in advance.

i not recommend installing ocsp web site other default web site (and not sure if supported scenario).

i not implement ocsp root ca, root ca issue subca certificates , long lived crl of root ca (and crl caching), no need implement ocsp.

for multiple cas, create revocation configuration for:

- each issuing ca in ca  hierarchy

- each active version of each issuing ca's certificate (when renew new key pair).

the ocsp signing certificate can come 1 issuing ca or each individual issuing ca. ms implementation not require ocsp signing certificate come same ca, must chain trusted root ca on clients.

brian

Windows Server  >  Security