Hasain Alshakarti

SYMPTOMS:

• You install the Routing and Remote Access Service (RRAS) role on a server that is running Windows Server 2008 R2.
• You configure the server to accept Layer Two Tunneling Protocol with IPsec (L2TP/IPsec) connections.
• You run the Netsh ipsec dynamic set config property=strongcrlcheck value=2 command to configure the StrongCRLCheck setting on the server.
• You revoke a certificate on a client computer. The certificate is used to make L2TP/IPsec connections to the RRAS server.
• You establish an L2TP/IPsec connection from the client computer to the server.
• The connection to the RRAS server is successful. However, you expect that the client computer cannot connect to the server.

Internet Explorer 7 and later. In order to confirm the identity of organizations that host secure webpages, certifying authorities issue security certificates. These certificates are validated when you request a secure webpage.

By default, Internet Explorer performs a number of steps in order to validate the security certificate for a secure website. If a certificate is invalid, is out-of-date, or improperly identifies the website in question, Internet Explorer displays a notification to the user.

As an additional verification step, many certifying authorities also provide a service that identifies certificates that have been recently revoked. Earlier versions of Internet Explorer displayed notifications when this service could not be reached.

Because the inability to reach these services does not necessarily indicate that a certificate has been revoked, many users complained that such notifications were “false positives.” After considerable negative feedback, these notifications were disabled by default in Internet Explorer 7 and later.

When enabled, the FEATURE_WARN_ON_SEC_CERT_REV_FAILED feature displays notifications when Internet Explorer cannot reach the certificate revocation service published by a certifying authority. By default, this feature is disabled for Internet Explorer. This feature is not supported for applications hosting the WebBrowser Control.

To enable this feature using the registry, add the name of the Internet Explorer executable file to the following setting.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WARN_ON_SEC_CERT_REV_FAILED]
“iexplore.exe”=dword:00000001

The feature is enabled when the value is set to (DWORD) 00000001 and disabled when the value is (DWORD) 00000000.

Just follow the steps below:

1. IE setting for CRL checking of the server certificate is enabled

2. Set the hostnames of servers hosting the CRL and /or OCSP to 127.0.0.1 in your hosts file

3. Execute [certutil.exe -urlcache * delete] to remove all cached CRLs

4. Start your browser and tell it to HTTPS:// to the site

5. It will take some time trying to check the CRL/OCSP from the non-existing server

6. After that you are on the site without any warnings! Not really what I expected?!

Firefox gives the same results and only Google Chrome gives us a warning…

What if the same happens with Code Signing? Interesting case we have!

/Hasain