2

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data

I can guess that issues with signature validation occur when checking the certificates' CRL and OCSP data in many areas such as

  • Authenticode & signed Powershell objects
  • Authentication
  • S/MIME
  • Servers downloading and verifying patches, or signed AV updates
  • ...?

How does one address the lack of external connectivity with regard to certificate revocation checking?

1

Revocation. OCSP and CRLs are pretty well irrelevant these days. They are not very effective for security. And if you can't reach the revocation authority, no problem, the browser happily ignores the network error and proceeds as if the certificates are unrevoked. So inability to make outbound connections for OCSP or CRLs shouldn't pose a problem.

Updates. The big one is downloading of updates (e.g., software updates, A/V updates). I think you may want to add a whitelist to your firewall of allowed outbound connections, so that machines can still get their security updates.

For Windows updates, I think you want to allow access to TCP ports 80 and 443 on the following domains:

*.download.windowsupdate.com
*.windowsupdate.com
download.microsoft.com
ntservicepack.microsoft.com
windowsupdate.microsoft.com
*.windowsupdate.microsoft.com
wustat.windows.com
update.microsoft.com
*.update.microsoft.com
test.stats.update.microsoft.com

See also Firewall rule to allow access to windows updates or other resources on a CDN?.

  • Is it too broad to say that OCSP/CRLs aren't effective? Or is it just not happening for web browsers notably HTTPS connections? I don't understand why the author made a special case of EV certificates unless the industry wants to put technical teeth behind EV. Also he seemed to neglect browser user certificate auth. Isn't CRLS/OCSP used there? or is that just on the back end? – goodguys_activate Jun 3 '12 at 6:43
  • 1
    Nice point about the AV updates, and additional firewall exceptions. I suppose I can get around the MSFT ports if I use a WSUS server. – goodguys_activate Jun 3 '12 at 6:48
0

OCSP messages are encoded in ASN.1 and are usually accessed over HTTP. If you are establishing a connection to a remote host then there should never be a problem accessing OCSP. As a rule of thumb if you need a PKI then you need OCSP.

On a side note, the PKI isn't always the best tool for the job. Often packaging an application with the public key to verify a new update or other forms of mobile code is perfectibility acceptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.