Adjusting timeouts for TLS CRL retrieval

This article applies to:

• Trustwave SEG 7.2 and above
• TLS functionality

Question:

• What is the timeout for retrieval of Certificate Revocation List (CRL) information?
• Servers with TLS enabled show long delays in accepting some messages

Procedure:

SEG/MailMarshal 7.2 and above allow you to configure the timeouts for CRL retrieval. These settings can be used to avoid long delays in the case of inaccessible CRLs.

If a CRL cannot be retrieved, processing continues. Rule conditions that check for revocation status might not be applied.

You can adjust several values that affect CRL retrieval.

The quickest single setting to reduce delays is the low transfer timeout.

Notes:

• If a certificate includes more than one CRL distribution point URL, the timeouts apply to EACH URL.
• In the worst case the default values could allow MailMarshal to wait for 45 seconds for each request to time out.
• By default a successful CRL retrieval is cached for 24 hours (see article Q14571).

Available Settings

1. Connection timeout: This value determines how long MailMarshal waits for an initial response from the CRL distribution point website.
   • Value name: CRLGetConnectTimeout
   • Default value: 15 (seconds)
2. Low transfer rate and timeout: These two values control timeout of the data transfer from the remote site. If the data transferred (KB per second) is less than the "low transfer rate" for more than the timeout time, then MailMarshal abandons the request.
   • Low transfer rate
     • Value name: CRLGetLowTransferRate
     • Default value: 1 (KB/second)
   • Low transfer timeout
     • Value name: CRLGetLowTransferTimeout
     • Default value: 30 (seconds)
3. HTTP redirects: This value determines how many redirects MailMarshal will follow for each request.
   • Value name: CRLGetMaxHttpRedirects
   • Default value: 5

To create or edit these settings:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Controller key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Controller
   • 10.X: value names have the prefix Controller. (Controller dot).
   • For full details of the location for each product version, see article Q10832.
3. Add or edit DWORD (integer) values as described above.
4. Set the valued as desired. Use decimal entry for ease of understanding.
5. Commit configuration changes.
6. Restart the Controller service on nodes.

Warning: As always, take due care when editing the Registry. Make a backup before making changes.