CRL Timeout

[Sanjay_S]

Hi All,

We are facing weird issue, few of the users are able to access a particular URL and few are not. In Tracker i see the below Detect Message.

Failed to fetch CRL. Make sure the security gateway has an outgoing http access, and that the proxy and DNS servers are well configured. 

Certificate Validation: CRL Timeout 

We upgraded the firewalls to R80.30 Take 196 2 days back, is that causing the issue? Or what is the solution for this please help.

Regards,

Sanjay S

[PhoneBoy]

Are the sites HTTPS by chance?
Is HTTPS Inspection enabled?
I could see this happening if both are true since SNI is validated out of band and that does involve checking the cert and CRL.

[Sanjay_S]

Yes those are https sites and https Inspection blade was enabled.

The issue was resolved after rebooting the server which was hosting the site. Thank you for your help 🙂

[Nasrat]

Is there an open SR for this issue?

[genisis__]

I'm seeing this in our logs,  we are not running https inspection but I see lots of entries related to "Failed to fetch CRL from the following URL"

I know the gateway can access the internet.

[PhoneBoy]

Even without HTTPS Inspection, SNI verification is done on HTTPS sites from R80.30+.

[genisis__]

Is there something I need to ensure the GW can retrieve these? or is the correct behaviour as a result of SNI verification?

[Chris_Atkinson]

Out of interest is OCSP traffic allowed by your policy?