2

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data

I can guess that issues with signature validation occur when checking the certificates' CRL and OCSP data in many areas such as

  • Authenticode & signed Powershell objects
  • Authentication
  • S/MIME
  • Servers downloading and verifying patches, or signed AV updates
  • ...?

How does one address the lack of external connectivity with regard to certificate revocation checking?

Improve this question

2 Answers 2

Reset to default
1

Revocation. OCSP and CRLs are pretty well irrelevant these days. They are not very effective for security. And if you can't reach the revocation authority, no problem, the browser happily ignores the network error and proceeds as if the certificates are unrevoked. So inability to make outbound connections for OCSP or CRLs shouldn't pose a problem.

Updates. The big one is downloading of updates (e.g., software updates, A/V updates). I think you may want to add a whitelist to your firewall of allowed outbound connections, so that machines can still get their security updates.

For Windows updates, I think you want to allow access to TCP ports 80 and 443 on the following domains:

*.download.windowsupdate.com
*.windowsupdate.com
download.microsoft.com
ntservicepack.microsoft.com
windowsupdate.microsoft.com
*.windowsupdate.microsoft.com
wustat.windows.com
update.microsoft.com
*.update.microsoft.com
test.stats.update.microsoft.com

See also Firewall rule to allow access to windows updates or other resources on a CDN?.

Improve this answer
2
  • Is it too broad to say that OCSP/CRLs aren't effective? Or is it just not happening for web browsers notably HTTPS connections? I don't understand why the author made a special case of EV certificates unless the industry wants to put technical teeth behind EV. Also he seemed to neglect browser user certificate auth. Isn't CRLS/OCSP used there? or is that just on the back end?
    – makerofthings7
    Jun 3, 2012 at 6:43
  • 1
    Nice point about the AV updates, and additional firewall exceptions. I suppose I can get around the MSFT ports if I use a WSUS server.
    – makerofthings7
    Jun 3, 2012 at 6:48
0

OCSP messages are encoded in ASN.1 and are usually accessed over HTTP. If you are establishing a connection to a remote host then there should never be a problem accessing OCSP. As a rule of thumb if you need a PKI then you need OCSP.

On a side note, the PKI isn't always the best tool for the job. Often packaging an application with the public key to verify a new update or other forms of mobile code is perfectibility acceptable.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .