2012年4月6日 星期五

Ignore Offline CRL Errors on the CA

Normally, a Windows Server 2003 CA will always check revocation on all certificates in the PKI hierarchy (except the root CA certificate) before issuing an end-entity certificate.

You have imported the CA root to the Lync-edge server, and You can see the detail in the Certificate Store under Trusted Root CA.
You generated the certificate for the internal interface, have it signed, and then assigned it. You got the Error Message


There are two possibilities to get this Error working:
- Recommended: Modify your CA Configuration to include a HTTP CRL Publishing point, publish the CRL to this location and request a new certificate for the internal Lync server with this new CRL location. Make sure that the edge server can download the CRL from this location

- Disable CRL checking on the Edge server. By doing this, you configure the system to no longer check CRL's for certificate revocation. While this is not a recommended practice from a security perspective, it will work.

Or You can try disabling it in IE advanced properties ("Check for publishers certificate revocation" option) and reboot the server and see if it has any affect on lync

The other way to disable this feature, use the following command on the CA, and then restart the CA service:
certutil –setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE

沒有留言:

Skype for Business 相關問題

Microsoft Teams 擴展了 Skype for Business 功能,將聊天、會議、通話、協同合作、應用程式和檔案儲存整合到一個介面中。這個新的團隊合作中心可以幫助簡化使用者完成工作的方式,提高使用者滿意度,並加速業務結果。作為一個現有的 Skype for Bus...