When I launch my Windows, certificate revocation checks are performed. These occur once when explorer.exe is launched then periodically, every 40 minutes approximately, to 5 IPs. Most of these target Microsoft, Google or Akamai hosts usually geolocated in the Netherlands and US. Disconcerting however is the call to crl.microsoft.com which resolves at an IP controlled by my ISP. I do not use my ISP's DNS and apply a third party DNS ([email protected]) at the OS level using Windows Internet Options.
According to the DNS reply, the host names resolve as follows: CNAME crl.microsoft.com -> ms.akadns.net -> a1363.dscg.akamai.net -> Address 62...*** (ASN: 5089).
But this IP address is registered to my ISP, not Akamai or Microsoft. I don't have any reason to believe my ISP is partnered with Akamai or Microsoft.
After, a Certificate Revocation List is obtained from my ISP's "crl.microsoft.com" address.
When doing a domain-name look-up elsewhere ms.akadns.net resolves to other subhost names and addresses, so the problem is occurring at the ms.akadns.net > a1363.dscg.akamai.net translation step.
a1363.dscg.akamai.net fails to resolve to anything when looked up directly.
My system is clean and I don't use any ISP software. My (ISP-locked) modem is the only ISP hardware on my network.
A very similar problem is described here but I'm not in Romania. The novice user "solves" their problem by disabling the "check for certificate revocation" options on their system.
I was wondering whether somebody could explain what I should do next to gauge the extent of the problem. I would like to cross reference the certificates that I'm getting from the untrusted address against what they should be.
Edit: So other people can find this issue. The outgoing connections are made Svchost.exe using the CryptSvc and DNScache service. Requests to certificating servers are made using the Microsoft-CryptoAPI header.