topic Re: CRL Timeout in Firewall and Security Management

CRL Timeout

Sanjay_S — Fri, 26 Jun 2020 14:29:05 GMT

Hi All,

We are facing weird issue, few of the users are able to access a particular URL and few are not. In Tracker i see the below Detect Message.

Failed to fetch CRL. Make sure the security gateway has an outgoing http access, and that the proxy and DNS servers are well configured.

Certificate Validation: CRL Timeout

We upgraded the firewalls to R80.30 Take 196 2 days back, is that causing the issue? Or what is the solution for this please help.

Regards,

Sanjay S

Re: CRL Timeout

PhoneBoy — Thu, 02 Jul 2020 21:41:50 GMT

Are the sites HTTPS by chance?
Is HTTPS Inspection enabled?
I could see this happening if both are true since SNI is validated out of band and that does involve checking the cert and CRL.

Re: CRL Timeout

Nasrat — Mon, 06 Jul 2020 08:09:05 GMT

Is there an open SR for this issue?

Re: CRL Timeout

Sanjay_S — Tue, 14 Jul 2020 11:57:28 GMT

Yes those are https sites and https Inspection blade was enabled.

The issue was resolved after rebooting the server which was hosting the site. Thank you for your help 🙂

Re: CRL Timeout

genisis__ — Mon, 07 Dec 2020 12:49:00 GMT

I'm seeing this in our logs, we are not running https inspection but I see lots of entries related to "Failed to fetch CRL from the following URL"

I know the gateway can access the internet.

Re: CRL Timeout

PhoneBoy — Mon, 07 Dec 2020 20:42:20 GMT

Even without HTTPS Inspection, SNI verification is done on HTTPS sites from R80.30+.

Re: CRL Timeout

genisis__ — Sun, 13 Dec 2020 10:04:39 GMT

Is there something I need to ensure the GW can retrieve these? or is the correct behaviour as a result of SNI verification?

Re: CRL Timeout

Chris_Atkinson — Sun, 13 Dec 2020 10:35:34 GMT

Out of interest is OCSP traffic allowed by your policy?