3

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate Revocation List).

There is a need to change our proxy so I am attempting to investigate the impact of doing so. I have removed the global proxy settings using the command netsh winhttp proxy refesh, and also deleted the CRL cache using the command certutil -URLcache CRL delete.

However, after doing this, all calls to the web service still succeed. This suggests to me that I am missing something here.

So; If the CRL cache is cleared and the server has no way of refreshing the CRL, why do web service requets not return http 403?.

I have been unable to find adequate information from googling nor from my colleagues.

The reason I want it to fail is that I will not be confident that the new proxy settings work until I can see it broken first, if that makes sense.

I would also like to be able to force the CRL to be refeshed in order to ensure that the new proxy settings work

1 Answer 1

2

I might be mistaken, but if the server has no way to check the CRL, there is no way to "revoke" the certificate. So hence it would continue to work. The CRL isn't an "allow" list, but rather a "deny" list.

4
  • Sounds logical but I was under the impression that if a CRL cannot be checked, cached or otherwise, then the request will be forbiden. Perhaps I was wrong?
    – lockstock
    Nov 21, 2012 at 2:38
  • Might be dependent on the application and how it uses the cert. It might make sense to have it work that way in instances where the CRL might be blocked so the machines would continue to trust the cert even though it had been revoked. say like user or machine certs used for VPN for example..
    – MikeAWood
    Nov 28, 2012 at 20:38
  • Any idea where I can see/change what 'CRL lookup' settings are being used?
    – lockstock
    Nov 28, 2012 at 23:58
  • if you open the certificate, you can see the CRL Distribution points in the cert. That should show you were it is pointing. I believe its always a URI. For example, my company uses GoDaddy for our cert and our CRL URI is crl.godaddy.com/gds1-60.crl
    – MikeAWood
    Nov 30, 2012 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .