Hi Guys,

Just wanted to share with you some problem I had with UAG when publishing OWA 2007 (SSL to SSL)
I configured the environment, the Login process worked great but I felt some slowness after the authentication phase and then I got the following error "An unknown error occurred while processing the certificate"



With the following events on the UAG server:





I've made some research and The solution is:

The UAG server had no access (Layer 3 / 4) and name resolution to the CDP (CRL Distribution Points)

HTH

Hi Chris,

Personally I would fix the CRL problem, as a properly configured PKI should be publishing CRLs as they are a key part of the design. Once you have configured CRL publishing, you can then re-issue the certs (which now contains the correct CDPs) and CRL checking should then work successfully if UAG has access to the CDPs.

I think you can disable CRL checking with this:

Set the StrongCRL value in the registry, under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\ key, add a new Oakley subkey, with a DWORD entry: StrongCRLCheck, and assign it a value of 0.

Cheers

JJ

Is there any way to selectively disable CRL lookups per CA for UAG like the SiteMinder product? The reason I ask is because DoD CDP CRL files are typically very huge, some have been several hundred MB. After a CRL expires, having the first DoD user wait an unacceptable period while the huge CRL's are cached on UAG is not acceptable. The workaround for this for my company has been an automated script to pull down the large CRL's every evening, convert them to ascii, parse the list against AD and deny access to the customer in AD. On the UAG server, the CRL lookup would be disabled without compromizing PKI security. On the other hand, internal CRL lookups are desired. Having UAG only perfoming CRL lookups against the CA's that are desired is something that is needed. Looking at a OCSP responder may be an alternate resolution. However, not all 3rd party CA's configure certs for OCSP. Thoughts?

Joe

OK I found it in the UAG 2010 help and it successfully disabled CRL checking for testing purposes. Hope this helps someone.

HKEY_LOCAL_MACHINE\SOFTWARE\WhaleCom\e-Gap\Von\URLFilter\Comm\SSL

"By default Forefront UAG validates the both the certificate and the revocation list of each SSL backend server during the TLS handshake procedure. In the event where the either the certificate or the CRL are not valid, backend users shall be denied access to that given backend server. If an UAG admin wishes to disable that test due to any kind of reason she should set 'ValidateRwsCert' and 'ValidateRwsCertCRL' to '0' and restart the IIS service by 'iisreset' preferably."

Cool, thanks for the follow up :)