What does a Windows Online Responder need before it can answer OCSP requests?

Its own OCSP Response Signing certificate (from a duplicated template the responder's computer account may enroll for), a revocation configuration bound to the CA certificate, and a published CRL to read revocation data from.

1. Publish an initial CRL on the CA ("Revoked Certificates", Publish), even if empty. The responder builds its answers from the CA's CRLs.
2. Duplicate the "OCSP Response Signing" template and on its Security tab add the computer object of the server running the Online Responder (here the domain controller; the object-type filter must include Computers). The responder signs every answer and needs a certificate with the OCSPSigning EKU for that; it enrolls for it as a machine.
3. Issue the template on the CA (Certificate Template to Issue).
4. Create a Revocation Configuration in ocsp.msc: choose "existing enterprise CA", select the CA certificate; the responder then auto-enrolls for its signing certificate from the new template.
5. Enable the NONCE extension in the configuration's Signing tab, because Apache sends nonces by default.
6. Refresh revocation data, and check the whole chain, CDP, AIA and OCSP locations with pkiview.msc; all entries should read OK.

Running the responder on its own server is recommended in practice: OCSP must be reachable all the time, while the CA can then be better isolated.

Go deeper:

• RFC 6960: OCSP — section 4.2.2.2 on delegated responders signing with an id-kp-OCSPSigning certificate.
• Microsoft Learn: What is Active Directory Certificate Services? — the Online Responder role service.