Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have imported into the Trusted Certificate Store.

My VPN works, but only if I disable revocation checking on the client via the registry, and what I have found is that the CRL for my certificate doesn't exist. The name of my certificate is dcom-dc01.dcomproductions.com, but when I check the CertEnroll folder in IIS the CRL for it is not listed. Only the CRL for the original created during Certificate Authority setup exists (DCOM-DC01-CA). I tried to do Actions -> Publish but it still does not publish the CRL.

How can I correct this?

My CRL distribution points are configured to:

C:\Windows\system32\CertSrv\CertEnroll\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>
file://<ServerDNSName>/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
http://EXTERNALIP/CertEnroll/<CaName>/<CRLNameSuffix>/<DeltaCRLAllowed>.crl

Where EXTERNALIP is of course the publicly accessible IP for the server. The only one I changed was HTTP, because my understanding is that this is where clients check for the CRL.

share|improve this question
    
What CRL distribution points are configured in the Certificate Authority MMC? –  Shane Madden Dec 30 '12 at 21:34
    
Updated my answer. –  David Anderson - DCOM Dec 30 '12 at 21:37
    
Which boxes are checked on those? Specifically, the "include in CDP extension" and "publish to this location" options. Can you check if it's successfully publishing to other locations, like the LDAP one? –  Shane Madden Dec 30 '12 at 21:41
    
I checked C:\System32\CertSrv\CertEnroll, and its not published there either. The Publish CRL's to this location box is checked only for the first of the four options (the physical file path), but not for the others. It's greyed out for HTTP. The two Include options (CRL and CDP) are both checked for file:// and http:// –  David Anderson - DCOM Dec 30 '12 at 21:53
    
Interesting. Check for any errors in the event log? Try running certutil -crl in a command prompt (in admin mode, if you have UAC enabled)? –  Shane Madden Dec 30 '12 at 23:41
show 1 more comment

1 Answer

First you have an 2 extra "/" in the http address, it should be:

http://EXTERNALIP/CertEnroll/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

Second, you need to issue another certificate to be used in your IIS (AND) on the VPN 3rd, you need port 80 open on your IIS

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.