Enabling Certificate Revocation Checking in Internet Information Server 4.0

ID: Q232165

The information in this article applies to:
IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SUMMARY

Microsoft Internet Information Server (IIS) 4.0 in combination with Microsoft Certificate Server 1.0 make an excellent platform for distributing client authentication certificates. An important part of certificates is the ability to revoke a certificate (for instance, when a person leaves the company).

By default, certificate revocation checking is disabled in IIS 4.0 due to the time involved in performing the check, especially if the CRL (Certificate Revocation List) happens to be on another server across the Internet.


MORE INFORMATION

To perform CRL checking in IIS 4.0 (SP4 and earlier), do the following:

  1. Install IIS 4.0 and Certificate Server.


  2. Install the root certificate authority of Certificate Server into Internet Explorer 4.0 (by going to the Certsrv Web page on the local computer, or by importing the certificate).


  3. Run %windir%\system32\inetsrv\iisca.exe to mirror root certificates from Internet Explorer 4.0 to IIS.


  4. Run net stop iisadmin /y.


  5. Go to the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters
    Create the DWORD registry value CheckCertRevocation and set the value to 1.

    WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

    For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).


  6. Restart the required services (net start w3svc).


  7. Build an initial Certificate Revocation List (see below).


Perform the following steps for each secure Web site:
  1. Configure the Web/virtual directory/directory for Secure connections.


  2. Configure the Web/virtual directory/directory to accept client certificates.


  3. Get client certificates from Certificate Server (from http://server/certsrv (where server is the name of the computer hosting the Certificate Server).


  4. Select Certificate Enrollment Tools and choose Request a Client Authentication Certificate.


To test the configuration, do the following:
  1. Test the client certificate (from step 3 above) by browsing to the content that requires certificates. This should succeed.


  2. Revoke this client certificate by choosing Certificate Administration Log Utility from http://server/certsv (where server is the name of the server running certificate server), click the sequence number of the certificate you want to revoke, and then click the Revoke button on the next screen.


  3. Build the Certificate Revocation List (see below).


  4. Test the client certificate again by browsing to the content that requires client certificates. This request should fail.


  5. From now on, whenever IIS attempts to read a client certificate, it will check the CRL first.



To build a Certificate Revocation List, do one of the following:
IMPORTANT: This is an unsupported configuration in Internet Information Server 4.0 and Certificate Services 1.0.

Additional query words: 


Keywords          : 
Version           : winnt:4.0
Platform          : winnt 
Issue type        : kbhowto

Last Reviewed: August 3, 1999