Retrieval and Caching of Certificate Revocation Lists (CRLs)

This article applies to:

• Trustwave MailMarshal (SEG)
• Certificate Revocation Lists for TLS

Question:

• How does MailMarshal retrieve and keep CRLs used to check TLS certificates?
• How can I change the policies for CRL retention?
• How can I disable caching of CRLs?

Information:

MailMarshal can check the revocation status of a client certificate used for a received message (for details, see Help for the rule condition "Where the TLS client certificate matches criteria").

In order to check the status, MailMarshal must retrieve the CRL for the presented client certificate. This function is performed by the Controller service on each MailMarshal processing node. This function requires HTTP access (port 80 outbound), either direct or through the proxy server specified for the node.

To enhance performance, each node maintains a cache of CRLs that it has retrieved. When checking a certificate, MailMarshal attempts to use a cached copy of the CRL. If the CRL is not cached, or has exceeded the maximum allowed cache age, SEG retrieves the CRL from the CRL distribution point as specified in the certificate.

The CRL cache is stored in the Unpacking\Temp folder on the MailMarshal node installation, in a child folder CRLCache. Each CRL is stored in a separate file in DER format.

Default retention times

• By default, a cached CRL is considered valid for 24 hours. If a CRL is requested and the cached copy is more than 24 hours old, the Controller discards the local copy and attempts to retrieve a new copy.
• By default, a CRL that has not been retrieved or updated within 48 hours is purged (deleted from disk). The purge process occurs hourly.

Adjusting retention times

You can change the retention time settings by setting Registry entries. Make the Registry changes on the Array Manager. The settings apply to all nodes.

• In MailMarshal 10.0 and above, open the Management Console and navigate to Advanced Settings. Add or edit either or both of the following values:
  • Controller.CRLCacheExpiryHours (Integer): Number of hours cached CRLs are valid. Default: 24. To disable caching, set the value to 0.  
  • Controller.CRLCachePurgeDeferHours: (Integer): Number of hours CRLs will be retained on disk after expiry before being deleted (deletion occurs after CRLCacheExpiryHours+CRLCachePurgeDeferHours). Default: 24 .
    • Special case for debugging: if both values are set to 0, caching is disabled and no new cache files will be written, but no existing cache files will be deleted.
• In MailMarshal 8.X and below, open the Registry Editor on the Array Manager. Within the base registry key, navigate to \Default\Controller
  • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Controller
  • For information about the registry location for each version, see article Q10832.
  • Add or edit either or both of the following DWORD values:
    • CRLCacheExpiryHours: Number of hours cached CRLs are valid. Default: 24 (decimal). To disable caching, set the value to 0.  
    • CRLCachePurgeDeferHours: Number of hours CRLs will be retained on disk after expiry before being deleted (deletion occurs after CRLCacheExpiryHours+CRLCachePurgeDeferHours). Default: 24 (decimal).
      • Special case for debugging: if both values are set to 0, caching is disabled and no new cache files will be written, but no existing cache files will be deleted.
• Save your registry settings or configuration settings.
• Commit the configuration changes and restart the MailMarshal Controller service on each node.

As always, take due care when editing the Registry. Trustwave recommends that you make a backup before applying any changes.

Notes:

If CRLs cannot be retrieved at all, verify the internet access settings in TWO locations, even for a single server installation:

• System Configuration (or MailMarshal Properties) > Internet Access
• Server and Array Configuration > Server Properties for the individual server > Internet access (Customize...)