Enabling Certificate Revocation Checking in Internet Information Server 4.0

• Microsoft Internet Information Server version 4.0

SUMMARY

Microsoft Internet Information Server (IIS) 4.0 in combination with Microsoft Certificate Server 1.0 make an excellent platform for distributing client authentication certificates. An important part of certificates is the ability to revoke a certificate (for instance, when a person leaves the company).

By default, certificate revocation checking is disabled in IIS 4.0 due to the time involved in performing the check, especially if the CRL (Certificate Revocation List) happens to be on another server across the Internet.

MORE INFORMATION

To perform CRL checking in IIS 4.0 (SP4 and earlier), do the following:

1. Install IIS 4.0 and Certificate Server.



2. Install the root certificate authority of Certificate Server into Internet Explorer 4.0 (by going to the Certsrv Web page on the local computer, or by importing the certificate).



3. Run %windir%\system32\inetsrv\iisca.exe to mirror root certificates from Internet Explorer 4.0 to IIS.



4. Run net stop iisadmin /y.



5. Go to the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters

   Create the DWORD registry value CheckCertRevocation and set the value to 1.
   
   WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.
   
   For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).
   



6. Restart the required services (net start w3svc).



7. Build an initial Certificate Revocation List (see below).

1. Configure the Web/virtual directory/directory for Secure connections.



2. Configure the Web/virtual directory/directory to accept client certificates.



3. Get client certificates from Certificate Server (from http://server/certsrv (where server is the name of the computer hosting the Certificate Server).



4. Select Certificate Enrollment Tools and choose Request a Client Authentication Certificate.

1. Test the client certificate (from step 3 above) by browsing to the content that requires certificates. This should succeed.



2. Revoke this client certificate by choosing Certificate Administration Log Utility from http://server/certsv (where server is the name of the server running certificate server), click the sequence number of the certificate you want to revoke, and then click the Revoke button on the next screen.



3. Build the Certificate Revocation List (see below).



4. Test the client certificate again by browsing to the content that requires client certificates. This request should fail.



5. From now on, whenever IIS attempts to read a client certificate, it will check the CRL first.

• Click Start, point to Programs, point to Windows NT Option Pack, click Certificate Server, and then choose Generate New Certificate Revocation List.
  
  -or-



• Type certutil -CRL from a command prompt.

Additional query words:

Keywords :
Version : winnt:4.0
Platform : winnt
Issue type : kbhowto