Article ID: 232165
Article Last Modified on 6/23/2005
APPLIES TO
- Microsoft Internet Information Server 4.0
This article was previously published under Q232165
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SUMMARY
Microsoft Internet Information Server (IIS) 4.0 in combination with Microsoft Certificate Server 1.0 make an excellent platform for distributing client authentication certificates. An important part of certificates is the ability to revoke a certificate (for instance, when a person leaves the company).
By default, certificate revocation checking is disabled in IIS 4.0 due to the time involved in performing the check, especially if the CRL (Certificate Revocation List) happens to be on another server across the Internet.
MORE INFORMATION
To perform CRL checking in IIS 4.0 (SP4 and earlier), do the following:
- Install IIS 4.0 and Certificate Server.
- Install the root certificate authority of Certificate Server into Internet Explorer 4.0 (by going to the Certsrv Web page on the local computer, or by importing the certificate).
- Run %windir%\system32\inetsrv\iisca.exe to mirror root certificates from Internet Explorer 4.0 to IIS.
- Run net stop iisadmin /y.
- Go to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inetinfo\Parameters
Create the DWORD registry value CheckCertRevocation and set the value to 1.
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
- Restart the required services (net start w3svc).
- Build an initial Certificate Revocation List (see below).
Perform the following steps for each secure Web site:
- Configure the Web/virtual directory/directory for Secure connections.
- Configure the Web/virtual directory/directory to accept client certificates.
- Get client certificates from Certificate Server (from http://server/certsrv (where server is the name of the computer hosting the Certificate Server).
- Select Certificate Enrollment Tools and choose Request a Client Authentication Certificate.
To test the configuration, do the following:
- Test the client certificate (from step 3 above) by browsing to the content that requires certificates. This should succeed.
- Revoke this client certificate by choosing Certificate Administration Log Utility from http://server/certsv (where server is the name of the server running certificate server), click the sequence number of the certificate you want to revoke, and then click the Revoke button on the next screen.
- Build the Certificate Revocation List (see below).
- Test the client certificate again by browsing to the content that requires client certificates. This request should fail.
- From now on, whenever IIS attempts to read a client certificate, it will check the CRL first.
To build a Certificate Revocation List, do one of the following:
- Click Start, point to Programs, point to Windows NT Option Pack, click Certificate Server, and then choose Generate New Certificate Revocation List.
-or-
- Type certutil -CRL from a command prompt.
IMPORTANT: This is an unsupported configuration in Internet Information Server 4.0 and Certificate Services 1.0.
Keywords: kbhowto KB232165
