Adjusting timeouts for TLS CRL retrieval

This article applies to:

• MailMarshal (SEG)
• TLS functionality

Question:

• What is the timeout for retrieval of Certificate Revocation List (CRL) information?
• Servers with TLS enabled show long delays in accepting some messages

Procedure:

MailMarshal allows you to configure the timeouts for CRL retrieval. These settings can be used to avoid long delays in the case of inaccessible CRLs.

If a CRL cannot be retrieved, processing continues. Rule conditions that check for revocation status might not be applied.

You can adjust several values that affect CRL retrieval.

The quickest single setting to reduce delays is the low transfer timeout.

Notes:

• If a certificate includes more than one CRL distribution point URL, the timeouts apply to EACH URL.
• In the worst case the default values could allow MailMarshal to wait for 45 seconds for each request to time out.
• By default a successful CRL retrieval is cached for 24 hours (see article Q14571).

Available Settings

1. Connection timeout: This value determines how long MailMarshal waits for an initial response from the CRL distribution point website.
   • Value name: CRLGetConnectTimeout
   • Default value: 15 (seconds)
2. Low transfer rate and timeout: These two values control timeout of the data transfer from the remote site. If the data transferred (KB per second) is less than the "low transfer rate" for more than the timeout time, then MailMarshal abandons the request.
   • Low transfer rate
     • Value name: CRLGetLowTransferRate
     • Default value: 1 (KB/second)
   • Low transfer timeout
     • Value name: CRLGetLowTransferTimeout
     • Default value: 30 (seconds)
3. HTTP redirects: This value determines how many redirects MailMarshal will follow for each request.
   • Value name: CRLGetMaxHttpRedirects
   • Default value: 5

To create or edit these settings:

• In MailMarshal 10.0 and above, open the Management Console and navigate to Advanced Settings. Add one or more of these values:
  • Name: Controller.CRLGetConnectTimeout
  • Type: Integer
  • Value: The timeout in seconds
  • Name: Controller.CRLGetLowTransferRate
    • Type: Integer
    • Value: The rate in KB/second
  • Name: Controller.CRLGetLowTransferTimeout
    • Type: Integer
    • Value: The timeout in seconds
  • Name: Controller.CRLGetMaxHttpRedirects
    • Type: Integer
    • Value: The number of redirects to follow
• In MailMarshal 8.X, open the Registry Editor on the Array Manager. Within the base registry key, navigate to \Default\Controller
  • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Controller
  • For information about the registry location for each version, see article Q10832.
  • Enter one or more of the below values. Use Decimal entry to avoid confusion.
  • Name: Controller.CRLGetConnectTimeout
    • Type: DWORD 
    • Value: The timeout in seconds
  • Name: Controller.CRLGetLowTransferRate
    • Type: DWORD 
    • Value: The rate in KB/second
  • Name: Controller.CRLGetLowTransferTimeout
    • Type: DWORD 
    • Value: The timeout in seconds
  • Name: Controller.CRLGetMaxHttpRedirects
    • Type: DWORD 
    • Value: The number of redirects to follow
• Save your registry settings or configuration settings.
• Commit the configuration changes and restart the MailMarshal Controller service on each node.

Warning: As always, take due care when editing the Registry. Make a backup before making changes.