Subject: Help Sought on Netscape Revocation URL causing MS Programs to hang

From: "Ron Segal" <[email-masked]>
Date: Thu, 19 Apr 2001 13:59:13 +1200

Hi Folks

If an X.509 v3 certificate contains a proprietary NetscapeRevocationURL
extension and a Microsoft program (eg
email or browser) is configured to do automatic CRL Distribution Point
Checking, then the Microsoft program will hang and timeout after about 5
minutes.

Does anybody know of a fix for this problem, e.g. a registry configuration
(no cynicism please!)?

We are aware that if a cert has both the NetscapeRevocationURL and CRL
Distribution Point
extensions, then no problem.

Your help would be greatly appreciated (and maybe you can get a job at
Baycorp!).

Very best regards

Ron

--------------
Ron Segal
Business Development Manager
Baycorp ID Services Ltd
PO Box 5052, Wellington, New Zealand

Mailto: [email-masked]
Tel:   +64 (4)  499 4231
DD:    +64 (4)  499 4261
Mob:   +64 (21) 678 009
Fax:   +64 (4)  499 4233
Web:   http://www.baycorpid.com

---

From: Ryan Hurst <[email-masked]>
Date: Wed, 18 Apr 2001 21:04:00 -0700

Ron, Microsoft implements its revocation checking logic in a library called
cryptnet.dll, in this DLL there is an implementation of a function called
CryptVerifyRevocation. When the cryptnet.dll function is registered as a
provider to CryptVerifyRevocation it will be called when a revocation check
is requested. This DLL has had several updates and may or may not have this
behavior in all versions (What version of the OS and service pack are you
running?)

Regardless, there are several ways to work with this issue:

1. Disable revocation checking (which can be done by removing the
problematic CertVerifyRevocation provider in the registry, or at the
application level by telling the application not to check for revocation) --
Not much of a solution I know; but 5 min delay for attempting to retrieve
the CRL is insane.
2. ValiCert has a "Desktop Validator" solution that has an implementation of
the CryptVerifyRevocation call that supports OCSP, SCVP and CRLs. If you
install this plug-in you can configure it to supercede all other revocation
providers. In this configuration you would not be exposed to this problem.
However the shipping version of this product does not support automatically
retrieving CRLs based off of certificate extensions (aka CRLdp and
NetscapeRevocationURL). Instead you must configure either a default
OCSP/SCVP responder or specify a CA specify responder or CRL location. If
you would like to use OCSP we at ValiCert have a responder and the good
folks over at OpenSSL have been working on a implementation as-well.

Hope this helps,

Ryan M. Hurst

-----Original Message-----
From: Ron Segal [mailto:[email-masked]]
Sent: Wednesday, April 18, 2001 6:59 PM
To: [email-masked]
Subject: Help Sought on Netscape Revocation URL causing MS Programs to
hang

Hi Folks

Very best regards

Ron

--------------
Ron Segal

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 19 Apr 2001 16:08:14 -0700

Hi Ron
Sorry for the confusion, it is fixed in Windows XP. Revocation handling
is done as part of CryptoAPI which is an OS component.
Trevor

-----Original Message-----
From: Ron Segal [mailto:[email-masked]] 
Sent: Thursday, April 19, 2001 2:32 PM
To: David Cross
Cc: [email-masked]
Subject: RE: Help Sought on Netscape Revocation URL causing MS Programs
to hang

Hi David

Thanks for your offer to checkout the certificate chain.

Actually a clear explanation has now been offered by free Microsoft
support(unexpectedly rapid and knowedgable service I might add,
particularly
as it was a free web query).

It seems that if the revocation check itself is to a secure server
(https)
and the server certificate itself has a Nescape revocation extension a
recursive revocation process can occur.  Microsoft are providing a
partial
fix for this in their new version of Office (XP) by detecting the
recursion
and halting the process.  If this happens the revocation check will fail
to
provide revocation status. The optimum solution is to remove the
Netscape
revocation extension from the server certificate.

I'm copying this to the list so that others will see that the problem
has
been 'solved', and the solution (please note server cert providers!).

Hope that I did not miss any messages and personally thanked everybody
who
responded, at least that was the intention.

Very best regards

Ron

--------------
Ron Segal

Tel:   +64 (9)  356 5801
Fax:   +64 (9)  356 5818

If you received a warning on reading this email, please go to
<http://www.baycorpid.com/settings/email.asp> to update your settings

-----Original Message-----
From: David Cross [mailto:[email-masked]]
Sent: Friday, 20 April 2001 1:39 a.m.
To: Ron Segal; [email-masked]
Subject: RE: Help Sought on Netscape Revocation URL causing MS Programs
to hang

I will pass on the job offer, but have you verified that the URLs are
valid that are listed in the certificate?  If the URLs are no longer
valid or cannot be reached, that might explain the behaviour.  If you
want to send me the certificate chain (privately), we can take a look at
it.

David B. Cross

-----Original Message-----
From: Ron Segal [mailto:[email-masked]]
Sent: Wednesday, April 18, 2001 6:59 PM
To: [email-masked]
Subject: Help Sought on Netscape Revocation URL causing MS Programs to
hang

Hi Folks

If an X.509 v3 certificate contains a proprietary NetscapeRevocationURL
extension and a Microsoft program (eg email or browser) is configured to
do automatic CRL Distribution Point Checking, then the Microsoft program
will hang and timeout after about 5 minutes.

Does anybody know of a fix for this problem, e.g. a registry
configuration (no cynicism please!)?

We are aware that if a cert has both the NetscapeRevocationURL and CRL
Distribution Point extensions, then no problem.

Very best regards

Ron

--------------
Ron Segal