This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Revocation Check failed

Hello,

i have a problem with my exchange server certificate. Ever since from the beginning it says "Revocation Check failure"

All around the internet it is claimed as a proxy error so i tried to:

- skip or set the proxy for the normal user via netsh winhttp command

- skip or set the proxy for the normal user via IE settings

- skip or set the proxy for NT-Authority/SYSTEM User via netsh winhttp command

- skip or set the proxy for NT-Authority/SYSTEM User via IE settings

- Made an Exception in Filtering Options of the UTM to the Revocation URL shown in the Certificate

- Made an execption to the whole URL of the CA

I can download the CRL via Internet Explorer but the Exchange console still shows "Revocation Check Failure"

Nothing helps and i'm running out of ideas.

What can i do?

This thread was automatically locked due to age.

0 FormerMember over 3 years ago

Hi Revan,

Thank you for reaching out to the Community!

Could you please tell us about the configured web filtering operation mode on your firewall? Is it transparent or standard proxy?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Revan over 3 years ago in reply to FormerMember

It ist Standard Mode
Cancel
Vote Up 0 Vote Down

Cancel
0 Revan over 3 years ago in reply to FormerMember

No one with an idea?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to Revan

Hi Revan,

Did you try to add the domain/URL to Web Protection > Filtering Options > Misc > Transparent Mode Skiplist > Skip Transparent Mode Destination Hosts/Nets?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Revan over 3 years ago in reply to FormerMember

Can you explain this a bit more?

Should i add the external url of the mail server or the fqdn/internal ip-address?

How will this affect the security?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to Revan

Hi Revan,

Add the destination/external domain; this will only bypass web proxy for the traffic towards that external domain/URL.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Revan over 3 years ago in reply to FormerMember

Sorry that don't work either
Cancel
Vote Up 0 Vote Down

Cancel
0 PhilippRusch over 3 years ago in reply to Revan

Hello Revan,

are you sure, that you configured netsh winhttp set proxy FQDN_of_Sophos-FW:8080 bypass-list="crl.cahost.com" (Example)

correctly? Please try with and withput bypass-list.

Standard-mode on the UTM uses port 8080 as default-proxy-port, which is not automatically chosen by "netsh winhttp set proxy"

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Revan over 3 years ago in reply to PhilippRusch

Hi,

yes i tried it excessively. With fqdn, with ip address, with bypass list and without, as normal user, as system user.

Always waited min 30mins afterwards, mostly even more.
Cancel
Vote Up 0 Vote Down

Cancel
0 PhilippRusch over 3 years ago in reply to Revan

Did you use port 8080 for the proxy-setting?

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel