Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

[morris]

Hi Guys,

we currently have one client that cannot connect via VPN. It's the only client to have that issue at the moment.

SmartConsole says:
Main Mode Client Machine Certificate Error: Could not retrieve CRL.CN=XXX

I see allowed packets in the logs. If I curl_cli the CRL-Distribution-Point and tcpdump the traffic during client-login I see encrypted

-----BEGIN X509 CRL-----
abc123
-----END X509 CRL-----

which are in both cases the same.

All other clients can succesful login.

Do you have any clues?

[PhoneBoy]

Have you tried connecting to the CRL directly from the client in question (e.g. in a web browser)?
Have you tried having the client use a different ISP to see if port 18264 is possibly being blocked?

[morris]

The client cannot access to the CRL as he is not connected yet.

Does the client perform the CRL check? I always thought it was done by the gateway. Doesn't make sense to me if the client does it. The same with port 18264. I see allowed packets between gateway and management.

[PhoneBoy]

Certificates are used as part of the client VPN connection, which are checked against the CRL.
Very much relevant here.

[morris]

Yes, I understand. But who checks the certificate against the crl? The client or the gateway/management? 

All other clients can connect without any error message.

[PhoneBoy]

Depending on your configuration (e.g. Management is behind NAT), the client may send the CRL check through the gateway, but it's ultimately coming from the client.

[the_rock]

If its just single client, maybe have them reboot or reinstall the client. I would test with latest one, E88.62 version. Its highly unlikely its anything on the gateway side.

Andy

[morris]

The VPN-Gateway seems to use another interface to get to the CRL. And that access is dropped on another gateway.

It seems a little odd to me. The client accesses the same external interface with new and legacy certificate.

We are waiting for the other team to unlock the dropped traffic.

[the_rock]

Did you end up testing with the latest client, E88.62?

Andy