70-649 · Question #271
Your network contains an Active Directory domain named Contoso.com. Contoso.com contains an enterprise certification authority (CA) named CA1. You enable Secure Socket Tunneling Protocol (SSTP) on a…
The correct answer is D. Publish the certificate revocation list distribution point (CDP) to a location that is accessible from the Internet. specificconnection- failures.aspx Client tries to connect to SSTP VPN server and it fails to connect giving error message Trouble-shooting steps: This will happen if client is failing the certificate revocation check of the SSL certificateobtained from server side. This can…
Question
Your network contains an Active Directory domain named Contoso.com. Contoso.com contains an enterprise certification authority (CA) named CA1. You enable Secure Socket Tunneling Protocol (SSTP) on a server named Server1. A user named User1 attempts to establish an SSTP connection to Server1 and receives the following error message:
"Error 0x80092013: The revocation function was unable to check revocation because the revocation server was offline." You verify that all certificates services are online. You need to ensure that User1 can connect to Server1 by using SSTP. What should you do first?
Options
- AEnsure the CRL check servers on the server side are exposed on the Internet (i.e. are
- BCRL URL that is set inside the machine certificate on RRAS server is pointing to the internal
- CAdd a certificate to Server1 that contains Server1.contoso.com as a Subject Alternative Name (SAN).
- DPublish the certificate revocation list distribution point (CDP) to a location that is accessible from the Internet.
How the community answered
(28 responses)- A7% (2)
- B18% (5)
- C4% (1)
- D71% (20)
Explanation
specificconnection- failures.aspx Client tries to connect to SSTP VPN server and it fails to connect giving error message Trouble-shooting steps: This will happen if client is failing the certificate revocation check of the SSL certificateobtained from server side. This can happen because of two reasons: available on theInternet). This is because CRL check is done on the client side during SSL connection establishment phaseand the CRL check query will be directly going on the Internet (and not on top of VPN connection because it isnot up yet). DNS name (e.g. myvpn.contoso.local) and not the external name (special thanks to one of our esteemed customers, BillVoltmer, in pointing this out). To validate this, open the certificate snap-in on your RRAS server, go to detailstab and look at "CRL distribution point" field. To fix this: 1. Open Server Manager and navigate to Roles, Active Directory Certificate Services 2. Right click on CA name (e.g. mycompany-vpn1-CA) and choose Properties. 3. Click Extensions tab. 4. Select the pre-existing http: URL and click Remove. 7. Type external URL of VPN server 8. Type CertEnroll/ 9. Insert variable <CaName> 10. Insert variable <CRLNameSuffix> 11. Insert variable <DeltaCRLAllowed> 13. Check boxes Include in CRLs... and Include in the CDP... The above should be done before SSTP VPN is configured on RRAS. Or if it is already configured, change themachine certificate by following this blog.
Topics
Community Discussion
No community discussion yet for this question.