CRL checking in IIS 6

It turns out that it is indeed easy peasy to understand how CRLs work in IIS 6.

If the certificate contains a CRL Distribution Point (CDP), IIS will try to contact it and if it can’t, 403.13 is your friend.

Thus CRL checking will always take place in IIS except when:

• Certificates don’t contain a CDP.
• CertCheckMode is set to 1 for that particular website.

Note that if CertCheckMode is not set, IIS takes that to mean enabled and also note that CertCheckMode is set on a website by website basis.

Simple right?

I wish I'd found Saurabh Singh's very informative post before I'd spent half the morning messing about with an application server and a CA server trying to work out what was going on. I'd like to believe that I would have reached the same conclusion by myself and I certainly was close, after a myriad of tests revealed that adding a CRL file to the local computer trust store made absolutely no difference, which is what actually prompted me to have another go at googleing for the an answer, but who knows.

I wonder how IIS 7 deals with CRLs.

Disable CRL Checking in IIS 6

It's been a bit of nightmare today, we've had quite a number of issues, ranging from missing CA certs to firewall issues, with routing issues and DNS issues thrown into the mix for good measure.

One by one we sorted the issues out and we kept getting a 403.13 error. We even got the CRL and followed this, but to now avail.

Unfortunately, we have no control over the firewall, so we are waiting for this to be sorted out but in the mean time I found how to disable CRL checking in IIS 6. You just need to run the trusted adsutil.vbs script from c:\inetpub\adminscripts like this:

cscript adsutil.vbs SET w3svc/<websiteid>/CertCheckMode 1

After setting this, it all started working. To switch CRL checking back on, use this:

cscript adsutil.vbs SET w3svc/<websiteid>/CertCheckMode 0

Now I just need to understand how CRL checking works in IIS, easy peasy.