Could not retrieve an OCSP response.

Andreas 1,336

Hi,

We have 1 MS 2022 CA server, and have noticed on our DC`s the following error message

EventID 36928

Source Schannel

Could not retrieve an OCSP response.

   The Failure Reason is: REASON_OCSP_RESPONSE_RETRIEVAL_ERROR
    The OCSP Url is: 
   The previous OCSP response contained the following times:
      ThisUpdate: ‎1601‎-‎01‎-‎01T00:00:00.000000000Z
      NextUpdate: ‎1601‎-‎01‎-‎01T00:00:00.000000000Z

The attached data contains the certificate.

User's image

We don't have a OCSP installed, so why does this error message ? And as I understand we do not need any OCSP either. We only publish internal machine certificates so the machines can connect to the Wifi.

Please advice.

Thanks for any reply

Andy

Olivier David 0 Reputation points

2025-06-27T13:30:54.1433333+00:00

Hi Andy,

I've got the same issue, and I wonder how you manage to get the certificate ?
In the event log I've got the very same error, but I don't know how to get the "attached data".
Regards,

Olivier
Damon Boyer 45 Reputation points

2026-08-07T15:57:49.9666667+00:00

Same issue - did some diging and it's smartscreen trying to reach http://oneocsp.microsoft.com

Damon Boyer 45

Log Name: microsoft-windows-CAPI2/Operational

Source: Microsoft-Windows-CAPI2

Date: 8/7/2026 11:35:23 AM

Event ID: 53

Task Category: Retrieve Object from Network

Level: Information

Keywords: Automatic Root Update,Retrieval,Revocation,Path Discovery

User: <DOM\USER>

Computer: <SERVER>.<DOMAIN>

Description:

For more details for this event, please refer to the "Details" section

Event Xml:

<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />

<EventID>53</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>53</Task>

<Opcode>2</Opcode>

<Keywords>0x4000000000000036</Keywords>

<TimeCreated SystemTime="2026-08-07T15:35:23.3660423Z" />

<EventRecordID>52</EventRecordID>

<Correlation ActivityID="{00cc000c-0006-0000-2423-ac285022cc48}" />

<Execution ProcessID="8996" ThreadID="7520" />

<Channel>microsoft-windows-CAPI2/Operational</Channel>

<Computer><SERVER>.<DOMAIN></Computer>

<Security UserID="<USERGUID>" />
  </System>

  <UserData>

xml
<CryptRetrieveObjectByUrlWire>

  <URL scheme="http">http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D</URL>

  <Object type="CONTEXT_OID_OCSP_RESP" constant="6" />

  <Timeout>PT15S</Timeout>

  <Flags value="202004" CRYPT_WIRE_ONLY_RETRIEVAL="true" CRYPT_LDAP_SCOPE_BASE_ONLY_RETRIEVAL="true" CRYPT_PROXY_CACHE_RETRIEVAL="true" />

  <AuxInfo maxUrlRetrievalByteCount="104857600" cacheFileNamePrefix="B76BE66D46C355931939D8CF818D03FD_" fProxyCacheRetrieval="true" />

  <AdditionalInfo>

    <NetworkConnectivityStatus value="1" _SENSAPI_NETWORK_ALIVE_LAN="true" />

    <HTTPRequestHeadersInfo>

      <Header>GET /ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D HTTP/1.1</Header>

      <Header>Accept: */*</Header>

      <Header>User-Agent: Microsoft-CryptoAPI/10.0</Header>

      <Header>Connection: Keep-Alive</Header>

    </HTTPRequestHeadersInfo>

    <HTTPResponseHeadersInfo>

      <Header>HTTP/1.1 200 OK</Header>

      <Header>Cache-Control: max-age=300</Header>

      <Header>Date: Fri, 07 Aug 2026 15:37:44 GMT</Header>

      <Header>Content-Length: 1761</Header>

      <Header>Content-Type: application/ocsp-response</Header>

      <Header>Last-Modified: Wed, 05 Aug 2026 19:55:14 GMT</Header>

      <Header>ETag: bff0ea1a-9dd7-404b-8cde-a16d1732bb3c</Header>

      <Header>X-Cache: TCP_HIT</Header>

      <Header>Responder: DigiCert-http://msocsp.edge.digicert.com/</Header>

      <Header>X-MSEdge-Ref: Ref A: 98E2B629856147DD9E2B9698652D003D Ref B: MIAEDGE2517 Ref C: 2026-08-07T15:37:44Z</Header>

    </HTTPResponseHeadersInfo>

  </AdditionalInfo>

  <CacheInfo lastSyncTime="2026-08-07T15:35:23.349Z">

    <URLCacheResponseInfo responseType="CRYPTNET_URL_CACHE_RESPONSE_HTTP" lastModifiedTime="2026-08-05T19:55:14Z" maxAge="300" />

  </CacheInfo>

  <RetrievedObjects>

    <OCSPResponse fileRef="9C7028B8B9B4C8A7680C899D67C480A6D9389341.bin" />

  </RetrievedObjects>

  <EventAuxInfo ProcessName="smartscreen.exe" />

  <CorrelationAuxInfo TaskId="{CD2FF212-CBDE-4F24-8EB4-82B4A6730078}" SeqNumber="12" />

  <Result value="0" />

</CryptRetrieveObjectByUrlWire>
  </UserData>

</Event>

8 answers

Andreas 1,336 Reputation points

2023-02-03T07:45:16.1066667+00:00
Hi,

Thanks for reply, but this is just telling me generally about issues related to OSCP, please be more specific to my question since I am not following you.
1. We don't have a OCSP installed, so why does this error message ? And as I understand we do not need any OCSP either.
/R

Andy
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Limitless Technology 45,246 Reputation points

2023-02-02T17:20:00.03+00:00

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

Generally, an OCSP response cannot be retrieved when:

The certificate issuer is not responding to OCSP requests. This could be because the OCSP responder is either down or not configured properly to accept requests.

The issuing certificate authority (CA) has revoked the certificate and the revocation is not yet propagated.

The OCSP responder is not responding to the requests due to a network or server error.

The certificate is self-signed, meaning that it is not signed by a trusted CA and therefore not verifiable.

The issuing CA has not configured the OCSP responder correctly, or has not made the OCSP service available.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Limitless Technology 45,246 Reputation points

2023-02-02T17:19:43.1133333+00:00

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

Generally, an OCSP response cannot be retrieved when:

The certificate issuer is not responding to OCSP requests. This could be because the OCSP responder is either down or not configured properly to accept requests.

The issuing certificate authority (CA) has revoked the certificate and the revocation is not yet propagated.

The OCSP responder is not responding to the requests due to a network or server error.

The certificate is self-signed, meaning that it is not signed by a trusted CA and therefore not verifiable.

The issuing CA has not configured the OCSP responder correctly, or has not made the OCSP service available.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Could not retrieve an OCSP response.

8 answers

Your answer