We unchecked the CRL control check box in each certificate mappingunder Infrastructure>directory> certificate mapping
Under Infrastructure> X509 certifictae management> OSCP configuration:there's no OCSP configured. We did an authentication test but itfailed. In log file it look like policy server try to use CRL and OCSPand we don't understand why.
How can we fully disable CRL and OCSP from the Policy Server ?
First make sure that all CertMap have the option 3 set to 0, whichmean "CRL Check" disabled :
- On the Policy Server, open a command line windowm, and start XPSExplorer;
- XPSExplorer, navigate to CertMap objects (115) or look for the exact number in tool;
- List the certmaps : S
- Select the certmap to edit by selecting number
Enter Option (#, +, -, B, X, Y, M, Q): 1
- Get a writable copy by selecting W
Enter Option (MJLRPWDAX+Q): w
- Select the option # (for which we want change the value of the property)
03:*Flags = 8(0x8): for CRL Check
we need to change this value to 0 to disable the CRL Check.
- Validate the Record
Enter Option (# or MJLRPBVUDAX+Q): V
- Update the Record
Enter Option (# or MJLRPBVUDAX+Q): U Enter Option (# or MJLRPBVUDAX+Q): Q Enter Option (# or MJLRPBVUDAX+Q): Q Enter Option (#,F,B,X,P, or Q): P
- On each Policy Server :
- Go the Policy_Server_home/config folder; - Rename SMocsp.conf to SMocsp.conf.orig; - Restart the Policy Server;
KB : KB000130649
Thank you for sharing this tip with the community Patrick!
Tech Tip : CA Single Sign-On : Problem disactivate CRL checking