This message was deleted.
# citrix-vads
Slackbot
02/27/2023, 11:05 AMThis message was deleted.
j
John Gallacher
02/27/2023, 11:06 AMI have disabled the revocation check in a bid to get the going again but its still not grafting... I also see this:
John Gallacher
02/27/2023, 11:07 AMThe FAS servers/console looks healthy, IVe tried re-authorising etc, all green... ideas welcome 🙂
s
Salim Hurjuk
02/27/2023, 11:08 AMCheck any patches applied
j
John Gallacher
02/27/2023, 11:11 AMNo updates.. by the looks it started happening at 2pm on Friday...
s
Salim Hurjuk
02/27/2023, 11:12 AMAny cert update or security hardening?
j
John Gallacher
02/27/2023, 11:13 AMNo changes... apparently..
John Gallacher
02/27/2023, 11:14 AMThe revok check errors have stopped since I disabled the check... but users still get the logon prompt when launching and app/desktop..
John Gallacher
02/27/2023, 11:19 AMGot this from the VDA... its a revocation issue for sure...
d
Dennis Hirsch
02/27/2023, 11:43 AMDo you have access to the CA? If yes, check pkiview.msc for errors regarding CRL and CDP publishing
g
Geir Sandstad
02/27/2023, 11:50 AMThe revocation check is performed in every stage where a certificate is used.
We had the same issue after the server that hosted the CRL was moved and the firewall wasn't updated.
Geir Sandstad
02/27/2023, 11:51 AMYou can open the intermediate cert and find the URL used for CRL check there, and see if there any respons from that server via a web browser or similar.
j
John Gallacher
02/27/2023, 11:57 AMAwesome... thanks lads will have a look 🙂
John Gallacher
02/27/2023, 12:04 PMOdd.. I confirmed the revocation http location... I can dl the revoc file/list from the FAS servers and VDAs..
g
Geir Sandstad
02/27/2023, 12:07 PMIs that URL using http or https? If https, maybe the certificate has expired?
h
Henry Heres
02/27/2023, 12:08 PMCRL / AIA / OCSP needs to be golden, you can't just change it and expect it to update, every cert needs to be renewed then for revocation checks to be active. HTTP is the normal standard for this and if it's still default everything gets bloated in ADDS
g
Geir Sandstad
02/27/2023, 12:08 PMAlso, check the event log on the CA server, that might contain more details.
h
Henry Heres
02/27/2023, 12:09 PMre-publish your CRL and also do a new pkiview.msc and revoke the CAexchange cert so that it gets an update and will not use the cache
j
John Gallacher
02/27/2023, 12:09 PMCool... FAS servers are configured as Subordinate CA... does it need to be the root? I will have a look and see if anything of interest..
h
Henry Heres
02/27/2023, 12:09 PMno that doesn't make any difference it can be a subordinate or root
👍 1
Henry Heres
02/27/2023, 12:10 PMis your root still looking at a active CRL as well?
Henry Heres
02/27/2023, 12:10 PMthat one also if you do it correctly needs to be turned on again lets say every year for CRL publish (if you have an offline root ca)
j
John Gallacher
02/27/2023, 12:11 PMahh ok.. the root is offline and has been since FAS was setup.. and I think it was about a year ago..
John Gallacher
02/27/2023, 12:11 PMThat would make sense..
h
Henry Heres
02/27/2023, 12:13 PMI think you need to turn on the root and publish/copy the CRL file to your CRL location
j
John Gallacher
02/27/2023, 12:14 PMGot it... the root is online but Ive not got access... trying to get someone that does, cheers
h
Henry Heres
02/27/2023, 12:14 PMbut a pkiview.msc should also show you that
Henry Heres
02/27/2023, 12:15 PMthe root will have a red thingy cross on it's CRL
j
John Gallacher
02/27/2023, 12:18 PMYup.. thats it Henry... I can see it expired on Friday...
h
Henry Heres
02/27/2023, 12:18 PMyeah.. and it's also a bit yucky with file locations being published as a valid CRL
Henry Heres
02/27/2023, 12:19 PMnormally you don't want to see anything in there besides a valid HTTP location
g
Geir Sandstad
02/27/2023, 12:20 PMTip: leave a task for your self in the calendar 11 months from now to update this.. 🙂
✅ 1
j
John Gallacher
02/27/2023, 12:20 PMThanks folks, so in order to fix this I will need access to the Root yeah?
h
Henry Heres
02/27/2023, 12:21 PMyes correct, they need to turn on the root
Henry Heres
02/27/2023, 12:21 PMpublish a new CRL file under the revocation tab
Henry Heres
02/27/2023, 12:21 PMcopy that out and put it on the location where it servers the CRL for clients
Henry Heres
02/27/2023, 12:21 PMvalidate the entire flow with a pkiview.msc afterwards
Henry Heres
02/27/2023, 12:21 PMand of course turn off the root
j
John Gallacher
02/27/2023, 12:22 PMGot it Henry... this could be affecting other services in addtion to Citrix right?
John Gallacher
02/27/2023, 12:22 PMCitrix is all Ive heard of at this stage...
h
Henry Heres
02/27/2023, 12:22 PMand if you want some consultancy hours advise to use a cleaner root setup 🙂 with HTTP CRL only and subordinate the same with addendum for OCSP
🍻 1
Henry Heres
02/27/2023, 12:22 PMyes this would impact all CA related certificate and revocation services
Henry Heres
02/27/2023, 12:23 PMand especially smartcard logon / kerberos things
Henry Heres
02/27/2023, 12:23 PMI would think Wifi controllers would have some issues as well
j
John Gallacher
02/27/2023, 12:25 PMOf course their admin that normally managed this is off! 😛
🥲 1
c
c4rm0
02/27/2023, 6:49 PMSame thing happened to us a few months ago the offline Root CA crl expired had to republish it and copy to the subordinate CA
c4rm0
02/27/2023, 6:50 PMThis is article I used https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/
j
John Gallacher
02/27/2023, 7:41 PMThanks, John. I was looking at Aarons article earlier... managed to get it sorted. I had to re-enrol domain auth on the DCs but that was probably due to me reauthing/deploying templates etc before I realised it was the CRL... all good now, cheers 🙂
👍 2
5 Views