Hallo zusammen,
ich versuch gerade ein VPN mit SSTP aufzusetzen. Die Authentifizierung läuft über Smartcards, falls das relevant ist. Die VPN-Verbindung funktioniert perfekt, wenn ich in der Registry den Revocation-Test abschalte. Das ist aber natürlich keine dauerhafte Lösung. Das Netzwerk sieht folgendermaßen aus:
Interne Domäne: EXAMPLE.LOCAL
Externe Domäen: example.com
SSTP-Server SRV002.EXAMPLE.LOCAL
CA-Server SRV005.EXAMPLE.LOCAL
Von extern ist das ganze über vpnde.example.com erreichbar, Port 443 wird per Portforwarding auf den SSTP-Server weitergeleitet, der /CertEnroll/-Unterordner auf Port 80 wird auf den CA-Server geproxiet (gibt's das Wort?). Ich kann von extern mit dem Browser auf https://vpnde.example.com zugreifen (und auf /sra_{GUID}), das präsentierte Zertifikat ist auf vpnde.example.com ausgestellt.
Wenn ich damit manuell den Revocation-Check mittels certutil fahre, bekomme ich keine Fehlermeldung:
certutil -verify -urlfetch vpnde.example.com.crt
Issuer:
CN=ROOTCA
DC=EXAMPLE
DC=LOCAL
Subject:
CN=vpnde.example.com
Cert Serial Number: 7506e9f8000000000062
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 13 Hours, 53 Minutes, 9 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 13 Hours, 53 Minutes, 9 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
NotBefore: 06.02.2014 13:01
NotAfter: 06.02.2015 13:01
Subject: CN=vpnde.example.com
Serial: 7506e9f8000000000062
Template: 1.3.6.1.4.1.311.21.8.16492143.7127391.3359620.7208075.15308671.186.5532293.2496026
2a 46 ed 53 37 48 72 3f 94 70 07 10 ea fa 08 ec c6 bc 26 2f
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
Verified "Certificate (0)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/SRV005.EXAMPLE.LOCAL_ROOTCA.crt
---------------- Certificate CDP ----------------
Verified "Base CRL (0434)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/ROOTCA.crl
Verified "Delta CRL (0434)" Time: 0
[0.0.0] http://vpnde.example.com/CertEnroll/ROOTCA+.crl
---------------- Base CRL CDP ----------------
OK "Delta CRL (0435)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/ROOTCA+.crl
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
CRL 0434:
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
b9 d8 da 1d bb b9 bb de 87 79 bb ef 60 7e cb 0f 4b 19 7b 97
Delta CRL 0435:
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
81 9f a8 a1 e9 f8 01 12 30 b6 c6 9a 87 f9 db e2 d6 d4 b0 f5
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
Application[1] = 1.3.6.1.5.5.7.3.2 Client Authentication
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
NotBefore: 28.02.2011 20:58
NotAfter: 28.02.2021 21:08
Subject: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
Serial: 5e4be895575eb4af4361e80decedf0dc
74 e8 38 6a cd 97 23 3b ab 50 9d 9c 75 91 6d 76 23 4d 65 24
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
2e 5f 70 83 51 2e 3a a7 59 0b fb ea ce ad 07 5f 30 ad 2b f9
Full chain:
f5 21 a8 2e 1a 03 ba ad ca d7 6f b8 e5 52 e7 c1 24 15 cc c7
------------------------------------
Verified Issuance Policies: None
Verified Application Policies:
1.3.6.1.5.5.7.3.1 Server Authentication
1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
das ganze noch für das Client-Zertifikat:
certutil -verify -urlfetch client.crt
Issuer:
CN=ROOTCA
DC=EXAMPLE
DC=LOCAL
Subject:
CN=Last, First
OU=DE
OU=Employees
DC=EXAMPLE
DC=LOCAL
Cert Serial Number: 7508a3b5000000000064
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 13 Hours, 56 Minutes, 16 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 13 Hours, 56 Minutes, 16 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
NotBefore: 06.02.2014 13:03
NotAfter: 06.02.2015 13:03
Subject: CN="Last, First", OU=DE, OU=Employees, DC=EXAMPLE, DC=LOCAL
Serial: 7508a3b5000000000064
SubjectAltName: Other Name:Principal Name=first.last@EXAMPLE.LOCAL
Template: 1.3.6.1.4.1.311.21.8.16492143.7127391.3359620.7208075.15308671.186.10418322.10376827
97 a4 15 5e 0b b4 e0 36 76 8c 78 01 03 73 6e 14 db 5e db 1e
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
Verified "Certificate (0)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/SRV005.EXAMPLE.LOCAL_ROOTCA.crt
---------------- Certificate CDP ----------------
Verified "Base CRL (0434)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/ROOTCA.crl
Verified "Delta CRL (0434)" Time: 0
[0.0.0] http://vpnde.example.com/CertEnroll/ROOTCA+.crl
---------------- Base CRL CDP ----------------
OK "Delta CRL (0435)" Time: 0
[0.0] http://vpnde.example.com/CertEnroll/ROOTCA+.crl
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
CRL 0434:
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
b9 d8 da 1d bb b9 bb de 87 79 bb ef 60 7e cb 0f 4b 19 7b 97
Delta CRL 0435:
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
81 9f a8 a1 e9 f8 01 12 30 b6 c6 9a 87 f9 db e2 d6 d4 b0 f5
Application[0] = 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
Application[1] = 1.3.6.1.5.5.7.3.2 Client Authentication
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
NotBefore: 28.02.2011 20:58
NotAfter: 28.02.2021 21:08
Subject: CN=ROOTCA, DC=EXAMPLE, DC=LOCAL
Serial: 5e4be895575eb4af4361e80decedf0dc
74 e8 38 6a cd 97 23 3b ab 50 9d 9c 75 91 6d 76 23 4d 65 24
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
6f 58 39 ee 32 18 85 c1 e0 17 9a 7a 5c 9f 30 73 c7 64 6e 17
Full chain:
04 15 99 cf 01 18 99 c1 07 93 16 55 ea bc 30 fb 0e a8 b3 9e
------------------------------------
Verified Issuance Policies: None
Verified Application Policies:
1.3.6.1.4.1.311.20.2.2 Smart Card Logon
1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
Der verbindende Client ist ein Domänenmitglied, der angemeldete Benutzer ein Domänenbenutzer.
Beim Verbinden bekomme ich diese Fehlermeldung:
Error 0x80092013: The revocation function was unable to check revocation because the revocation server was offline.
Im EventLog steht folgendes:
Event ID 20227:
CoId={D07F7849-4A80-4239-B183-6E8EF8AE08C6}: The user EXAMPLE\first.last dialed a connection named VPN which has failed. The error code returned on failure is -2146885613.
Ich kann mir nicht genau erklären wieso diese Meldung kommt, das Zertifikat kann von außen eigentlich perfekt validiert werden. Kann es am fehlenden OCSP-Server liegen? Den kann ich leider nicht installieren, da wir keinen Enterprise-Server haben.
mfg Manu
