KnowledgeBase Archive

An Archive of Early Microsoft KnowledgeBase Articles

View on GitHub

Q232165: Enabling Certificate Revocation Checking in IIS 4.0

Article: Q232165
Product(s): Internet Information Server
Version(s): winnt:4.0
Operating System(s): 
Keyword(s): 
Last Modified: 11-JUN-2002

-------------------------------------------------------------------------------
The information in this article applies to:

- Microsoft Internet Information Server version 4.0 
-------------------------------------------------------------------------------

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

  Q256986 Description of the Microsoft Windows Registry

SUMMARY
=======

Microsoft Internet Information Server (IIS) 4.0 in combination with Microsoft
Certificate Server 1.0 make an excellent platform for distributing client
authentication certificates. An important part of certificates is the ability to
revoke a certificate (for instance, when a person leaves the company).

By default, certificate revocation checking is disabled in IIS 4.0 due to the
time involved in performing the check, especially if the CRL (Certificate
Revocation List) happens to be on another server across the Internet.

MORE INFORMATION
================

To perform CRL checking in IIS 4.0 (SP4 and earlier), do the following:

1. Install IIS 4.0 and Certificate Server.

2. Install the root certificate authority of Certificate Server into Internet
  Explorer 4.0 (by going to the Certsrv Web page on the local computer, or by
  importing the certificate).

3. Run %windir%\system32\inetsrv\iisca.exe to mirror root certificates from
  Internet Explorer 4.0 to IIS.

4. Run net stop iisadmin /y.

5. Go to the following registry key:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters

  Create the DWORD registry value CheckCertRevocation and set the value to 1.

  WARNING: If you use Registry Editor incorrectly, you may cause serious
  problems that may require you to reinstall your operating system. Microsoft
  cannot guarantee that you can solve problems that result from using Registry
  Editor incorrectly. Use Registry Editor at your own risk.

6. Restart the required services (net start w3svc).

7. Build an initial Certificate Revocation List (see below).

Perform the following steps for each secure Web site:

1. Configure the Web/virtual directory/directory for Secure connections.

2. Configure the Web/virtual directory/directory to accept client certificates.

3. Get client certificates from Certificate Server (from http://server/certsrv
  (where server is the name of the computer hosting the Certificate Server).

4. Select Certificate Enrollment Tools and choose Request a Client
  Authentication Certificate.

To test the configuration, do the following:

1. Test the client certificate (from step 3 above) by browsing to the content
  that requires certificates. This should succeed.

2. Revoke this client certificate by choosing Certificate Administration Log
  Utility from http://server/certsv (where server is the name of the server
  running certificate server), click the sequence number of the certificate you
  want to revoke, and then click the Revoke button on the next screen.

3. Build the Certificate Revocation List (see below).

4. Test the client certificate again by browsing to the content that requires
  client certificates. This request should fail.

5. From now on, whenever IIS attempts to read a client certificate, it will
  check the CRL first.

To build a Certificate Revocation List, do one of the following:

- Click Start, point to Programs, point to Windows NT Option Pack, click
  Certificate Server, and then choose Generate New Certificate Revocation
  List.

  -or-

- Type certutil -CRL from a command prompt.

IMPORTANT: This is an unsupported configuration in Internet Information Server
4.0 and Certificate Services 1.0.

Additional query words:

======================================================================
Keywords          :  
Technology        : kbiisSearch kbiis400
Version           : winnt:4.0
Issue type        : kbhowto

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.