[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

web server certificate contacting root CA

Posted on 2011-03-03
2
Medium Priority
?
537 Views
Last Modified: 2012-05-11
We are doing some internal testing using a web application hosted in IIS and using SSL security (On Windows 2003 Server).  We currently have a test web site that is using an internally created certificate (created from our internal CA structure) to SSL (https) the web page.  

First a look at our internal CA structure.  The Root CA is in our Root Domain (ourname.net) of our domain structure.  2 Subordinate CA’s are in the Sub-Domain (office.ourname.net) of our domain structure.

The web server and clients exists in office.ourname.net domain – shown below.

We did some network traffic monitoring while testing client access to the secured website.  When the client’s browser setting for “check for server certificate revocation” is turned on. – we were surprised to see traffic from our clients not only to the Subordinate CA (we expected this), but also to the Root CA.  We are assuming this was to check for a recent CRL (certificate revocation list) to make sure the given certificate has not since been revoked from its original creation.

domain
Given that we plan to take our Root CA offline in the near future – this is concerning.  

websrv
1.      Why would this be happening if the subordinate was the CA that issued the cert to the web server?  
2.      Was there an error in the way we created this certificate for the website?  
3.      Is there an error in the way we are handling CRL’s in relation to our Root CA?
4.      How can we offline our Root CA if it is actively publishing CRL’s - and apparently from this test - our clients will be looking from them.

(I know its 4 questions here - will split points if need be)
0
Comment
Question by:FLPeople
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 62

Assisted Solution

by:gheist
gheist earned 400 total points
ID: 35034721
If you take your CRL offline make sure web server is taken off and refuses http connections, so that users feel less timeout.
0
 
LVL 15

Accepted Solution

by:
pcsmitpra earned 1600 total points
ID: 35035890
1.      Why would this be happening if the subordinate was the CA that issued the cert to the web server?  
>>>> Have you placed the ROOT certificate in the place on webserver using certificate wizard ,becoz browser was trying to get root certificate.
2.      Was there an error in the way we created this certificate for the website?  
>>>> Does not seems though Not sure.
3.      Is there an error in the way we are handling CRL’s in relation to our Root CA?
>>>> Please check if CRL on your webserver is updated and not bad. You can find it in certificate wizard.
4.      How can we offline our Root CA if it is actively publishing CRL’s - and apparently from this test - our clients will be looking from them.
>>>> If Client gets the GOOD CRL , Root Cert and intermediate cert from Webserver itself it wont try to reach Root server, considering the FQDN is fine and SSL is placed to right domain with correct hostname. Probably you would like to import a latest CRL file from root server to web server.
0

Featured Post

Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Prologue It is often required to host multiple websites on a single instance of IIS, mostly in development environments instead of on production servers. I am sure it is not much a preferred solution on production servers but this is at least a pos…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question