Retrieval and Caching of Certificate Revocation Lists (CRLs)

This article applies to:

• Trustwave SEG (MailMarshal) 7.1 and above
• Certificate Revocation Lists for TLS

Question:

• How does SEG retrieve and keep CRLs used to check TLS certificates?
• How can I change the policies for CRL retention?
• How can I disable caching of CRLs?

Information:

SEG can check the revocation status of a client certificate used for a received message (for details, see Help for the rule condition "Where the TLS client certificate matches criteria").

In order to check the status, SEG must retrieve the CRL for the presented client certificate. This function is performed by the Controller service on each SEG processing node. This function requires HTTP access (port 80 outbound), either direct or through the proxy server specified for the node.

To enhance performance, each node maintains a cache of CRLs that it has retrieved. When checking a certificate, SEG attempts to use a cached copy of the CRL. If the CRL is not cached, or has exceeded the maximum allowed cache age, SEG retrieves the CRL from the CRL distribution point as specified in the certificate.

The CRL cache is stored in the Unpacking\Temp folder on the SEG node installation, in a child folder CRLCache. Each CRL is stored in a separate file in DER format.

Default retention times

• By default, a cached CRL is considered valid for 24 hours. If a CRL is requested and the cached copy is more than 24 hours old, the Controller discards the local copy and attempts to retrieve a new copy.
• By default, a CRL that has not been retrieved or updated within 48 hours is purged (deleted from disk). The purge process occurs hourly.

Adjusting retention times

You can change the retention time settings by setting Registry entries. Make the Registry changes on the Array Manager. The settings apply to all nodes.

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Controller key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Controller
   • 10.X: value names have the prefix Controller. (Controller dot).
   • For full details of the location for each product version, see article Q10832.
3. Add or edit either or both of the following DWORD values:
   • CRLCacheExpiryHours: Number of hours cached CRLs are valid. Default: 24 (decimal). To disable caching, set the value to 0.  
   • CRLCachePurgeDeferHours: Number of hours CRLs will be retained on disk after expiry before being deleted (deletion occurs after CRLCacheExpiryHours+CRLCachePurgeDeferHours). Default: 24 (decimal). 
     • Special case for debugging: if both values are set to 0, caching is disabled and no new cache files will be written, but no existing cache files will be deleted.
4. To apply the change, commit configuration and then restart the Controller service on all nodes.

As always, take due care when editing the Registry. Trustwave recommends that you make a backup before applying any changes.

Notes:

If CRLs cannot be retrieved at all, verify the internet access settings in TWO locations, even for a single server installation:

• SEG Properties > Internet Access
• Server and Array Configuration > Server Properties for the individual server > Internet access (Customize...)