2

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some timeouts.

Since the server has no access to the internet whatsoever, I'd like to disable CRL checks.

I had a similar issue on a Windows 2003 server and resolved it by adjusting the following registry keys: 

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Http/Parameters/SslBindiongInfo/0.0.0.0:443/DefaultSslCertCheckMode (DWORD=1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRevocationCheck (DWORD = 1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRootRevocationCheck (DWORD = 1)

That doesn't seem to be working in 2008. I've also tried disabling the CRL check from IE under Tools >> Internet Options >> Advanced.

Is there anything else I can try here?

Improve this question

3 Answers 3

Reset to default
1

I don't, but would it work to blackhole the crl server(s)? You can add 127.0.0.1 crl.host.domainnaame to the hosts file.

An example of this for another application is here:

Exchange Server 2007 managed code services do not start after you install an update rollup for Exchange Server 2007
http://support.microsoft.com/kb/944752

Improve this answer
3
  • That's an interesting idea, thanks. I'm not sure how that would work. Offhand, I would think that the timeout will still occur but perhaps not.
    – Mike B
    Jul 2, 2012 at 20:37
  • 1
    It's more common that you might think. We use it to blackhole our AD crl on our domain controllers because our smart card PKI does not use our AD CA. Have another look at the article, the blackhole workaround is to fix a timeout. ;-)
    – Greg Askew
    Jul 2, 2012 at 20:48
  • Heh, just read that part. Interesting. We'll give it a try. Thank you.
    – Mike B
    Jul 2, 2012 at 20:48
1

What we've found is whenever IIS worker process goes to sleep - by default idle time is 20 minutes and when it wakes up it goes through and checks a whole heap of things and CLR is one of the checks . Setting idle time to 0 and putting in recycling at specific is the best way to sort this .

Improve this answer
1

Maybe worth looking at this blog

http://www.page-house.com/blog/2009/04/how-to-disable-crl-checking.html

Disable CRL Checking Machine-Wide Control Panel -> Internet Options -> Advanced -> Under security, uncheck the Check for publisher's certificate revocation option

Disable CRL Checking For a Specific .Net Application See this Microsoft KB Article: http://support.microsoft.com/kb/936707

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .