Re: revoking ipsec certificate doesn't work

From: Brian Komar [MVP] (bkomar_at_nospam.identit.ca)
Date: 09/24/05

  • Next message: Altria: "tools to test security" 
    Date: Fri, 23 Sep 2005 22:18:58 -0500

    In article <OC33ceEwFHA.3864@TK2MSFTNGP12.phx.gbl>,
    franz.schenkNOSPAM@fititNO-_SPAM.ch says...
    > Thank you for your information.
    >
    > It's possible to publish manually the update delta and full CRL using the CA
    > MMC SnapIn on the Server. I also have verified that this CRL is published in
    > AD and in a file.
    > Despite of that, my test VPN client (or the VPN server) never checks if the
    > certificate using for the L2TP/IPSec connection is revoked or not. The Win
    > XP SP2 client can establish the L2TP/IPSec VPN connection to the Windows
    > Server 2003 SP1 without any problem after the certificate is revoked nearly
    > a week ago.
    >
    <snip>
    There are a couple of possibilities here:
    1) did you enable CRL checking for IPSec. in my whitepaper on
    Certificate Status and Revocation, I include a section discussing CRL
    checking for IPSec connections. Ensure that you have enabled the
    following registry setting at both the client and the server (moreso the
    server in your case):
    - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent
    \Oakley\
    StrongCrlCheck

    This Reg_DWORD data type can be assigned values from 0-2, with the
    following meanings:

    =3F 0 =3F Disables CRL checking for certificate-based IPSec authentication
     
    =3F 1 =3F Enables CRL checking and fails the validation process only if the
    CRL explicitly indicates that the certificate is revoked. All other
    failures, including when the CDP URL is unavailable, will be ignored.
     
    =3F 2 =3F Enables CRL checking and fails certificate validation on any CRL
    check errors.

    For maximum validation, set a value of 2, although a value of 1 would
    work in your case.

    2) The second issue may be that you have not modified the default CRL
    publication interval. The default value is to publish the base CRL every
    7 days. If you look at the troubleshooting whitepaper, you will see that
    a client will not download an updated CRL if a time valid CRL exists in
    the client's cache. The client will only download an updated CRL when
    the previous CRL expires from the cache (as per RFC 3280). For the
    details, see the whitepaper at
    http://www.microsoft.com/technet/security/topics/cryptographyetc/tshtcrl
    .mspx

    Brian

  • Next message: Altria: "tools to test security"

    Relevant Pages

    • Re: Certificate Question
      ... Client can use any cached CRL as long as it is valid. ... The other thing you can do is design your Base and Delta CRL ... Once the client gets new CRL it will not allow use of that certificate ... > I need to revoke a certificate because a user has left the company. ...
      (microsoft.public.windows.server.security)
    • Re: Problem with a smart card logon in the Domain A and Domain B
      ... the client PC. ... Check under Status column in GUI and in command line windows for any errors. ... > CRL that is defined in certificate and If it can't reach ... > CRL it will deny logon using smart card. ...
      (microsoft.public.security)
    • Re: Why doesnt IPSEC respect revoked certificates.
      ... You are probably seeing a cached CRL which is normal and expected behavior. ... > 1) Enterprise Certificate Authority, ... > 3) Created IPSEC Policies that require IPSEC for port 25 traffic- using ... > need to be on the Server and the Client - or else it doesn't work. ...
      (microsoft.public.win2000.security)
    • Re: Changing CA CRLs
      ... >> I thought that IIS will accept client certificates if the certificates CA is ... >> Then when a client certificate is presented to IIS the cached CRL is used to ... Vishal's statement that the old client certs should be re-issued, ...
      (microsoft.public.win2000.security)
    • Re: Certificate Question
      ... You may get clients that do not get a new CRL ... > Client can use any cached CRL as long as it is valid. ... > There is no harm in deleting certificate that was revoked, ... >> I need to revoke a certificate because a user has left the company. ...
      (microsoft.public.windows.server.security)