Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some timeouts.

Since the server has no access to the internet whatsoever, I'd like to disable CRL checks.

I had a similar issue on a Windows 2003 server and resolved it by adjusting the following registry keys:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Http/Parameters/SslBindiongInfo/0.0.0.0:443/DefaultSslCertCheckMode (DWORD=1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRevocationCheck (DWORD = 1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRootRevocationCheck (DWORD = 1)

That doesn't seem to be working in 2008. I've also tried disabling the CRL check from IE under Tools >> Internet Options >> Advanced.

Is there anything else I can try here?

share|improve this question
add comment

2 Answers

I don't, but would it work to blackhole the crl server(s)? You can add 127.0.0.1 crl.host.domainnaame to the hosts file.

An example of this for another application is here:

Exchange Server 2007 managed code services do not start after you install an update rollup for Exchange Server 2007
http://support.microsoft.com/kb/944752

share|improve this answer
    
That's an interesting idea, thanks. I'm not sure how that would work. Offhand, I would think that the timeout will still occur but perhaps not. –  Mike B Jul 2 '12 at 20:37
1  
It's more common that you might think. We use it to blackhole our AD crl on our domain controllers because our smart card PKI does not use our AD CA. Have another look at the article, the blackhole workaround is to fix a timeout. ;-) –  Greg Askew Jul 2 '12 at 20:48
    
Heh, just read that part. Interesting. We'll give it a try. Thank you. –  Mike B Jul 2 '12 at 20:48
add comment

What we've found is whenever IIS worker process goes to sleep - by default idle time is 20 minutes and when it wakes up it goes through and checks a whole heap of things and CLR is one of the checks . Setting idle time to 0 and putting in recycling at specific is the best way to sort this .

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.