topic Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX in SASE and Remote Access

Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

morris — Tue, 18 Feb 2025 10:15:34 GMT

Hi Guys,

we currently have one client that cannot connect via VPN. It's the only client to have that issue at the moment.

SmartConsole says:
Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

I see allowed packets in the logs. If I curl_cli the CRL-Distribution-Point and tcpdump the traffic during client-login I see encrypted

-----BEGIN X509 CRL-----
abc123
-----END X509 CRL-----

which are in both cases the same.

All other clients can succesful login.

Do you have any clues?

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

PhoneBoy — Tue, 18 Feb 2025 21:11:20 GMT

Have you tried connecting to the CRL directly from the client in question (e.g. in a web browser)?
Have you tried having the client use a different ISP to see if port 18264 is possibly being blocked?

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

the_rock — Tue, 18 Feb 2025 22:00:38 GMT

If its just single client, maybe have them reboot or reinstall the client. I would test with latest one, E88.62 version. Its highly unlikely its anything on the gateway side.

Andy

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

morris — Wed, 19 Feb 2025 09:13:29 GMT

The client cannot access to the CRL as he is not connected yet.

Does the client perform the CRL check? I always thought it was done by the gateway. Doesn't make sense to me if the client does it. The same with port 18264. I see allowed packets between gateway and management.

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

PhoneBoy — Wed, 19 Feb 2025 15:58:19 GMT

Certificates are used as part of the client VPN connection, which are checked against the CRL.
Very much relevant here.

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

morris — Thu, 20 Feb 2025 08:26:16 GMT

Yes, I understand. But who checks the certificate against the crl? The client or the gateway/management?

All other clients can connect without any error message.

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

PhoneBoy — Thu, 20 Feb 2025 13:08:21 GMT

Depending on your configuration (e.g. Management is behind NAT), the client may send the CRL check through the gateway, but it's ultimately coming from the client.

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

morris — Fri, 07 Mar 2025 15:26:06 GMT

The VPN-Gateway seems to use another interface to get to the CRL. And that access is dropped on another gateway.

It seems a little odd to me. The client accesses the same external interface with new and legacy certificate.

We are waiting for the other team to unlock the dropped traffic.

Re: Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

the_rock — Fri, 07 Mar 2025 15:59:16 GMT

Did you end up testing with the latest client, E88.62?

Andy