Revocation Check failed

Hi Revan,

Thank you for reaching out to the Community! 

Could you please tell us about the configured web filtering operation mode on your firewall? Is it transparent or standard proxy? 

Thanks,

No one with an idea?

Hello Revan,

are you sure, that you configured netsh winhttp set proxy FQDN_of_Sophos-FW:8080 bypass-list="crl.cahost.com" (Example)

correctly? Please try with and withput bypass-list.

Standard-mode on the UTM uses port 8080 as default-proxy-port, which is not automatically chosen by "netsh winhttp set proxy"

Hi,

yes i tried it excessively. With fqdn, with ip address, with bypass list and without, as normal user, as system user.

Always waited min 30mins afterwards, mostly even more.

Did you use port 8080 for the proxy-setting?

Hello Revan,

could you show us your command lines for setting winhttp proxy?

sorry for the late answer, was on vacation.

Yes, i used port 8080

netsh winhttp set proxy proxy-server="ip_of_the_server:8080" bypass-list="*.domain.local"

netsh winhttp set proxy proxy-server="fqdn_of_the_server:8080" bypass-list="*.domain.local"

netsh winhttp set proxy ip_of_the_server:8080

netsh winhttp set proxy fqdn_of_the_server:8080

netsh winhttp import proxy source =ie

netsh winhttp reset proxy

I also tried to change the proxy settings via psexec session as LOCAL SYSTEM User

netsh winhttp show proxy always tell me if the settings were applied

netsh winhttp set proxy proxy-server="ip_of_the_server:8080" bypass-list="*.domain.local"

netsh winhttp set proxy proxy-server="fqdn_of_the_server:8080" bypass-list="*.domain.local"

netsh winhttp set proxy ip_of_the_server:8080

netsh winhttp set proxy fqdn_of_the_server:8080

netsh winhttp import proxy source =ie

netsh winhttp reset proxy

I also tried to change the proxy settings via psexec session as LOCAL SYSTEM User

netsh winhttp show proxy always tell me if the settings were applied

Can you show us your EXACT command lines?

What do you mean?

netsh winhttp set proxy proxy-server="10.10.0.10:8080" bypass-list="*.domain.local"

netsh winhttp set proxy proxy-server="utm.domain.local:8080" bypass-list="*.domain.local"

Hello revan,

that looks ok.

Did you try this method here: https://docs.microsoft.com/en-us/archive/blogs/bshukla/certificate-revocation-checked-failed

Yes, thats what i meant with LOCAL SYSTEM User

Did you check proxy settings under that account?

I mean, did you do "netsh winhttp show proxy" under that account?

Yes, of course.