Search code examples
c#wcfsslhttpscertificate

CRL not working over http proxy

This is my situation.

client -> http proxy -> remote web server

LDAP ports and HTTP ports are blocked on firewall at client.

When sending request client must check CRL of remote web server's certificate to verify it's origin.

We did set ServicePointManager.CheckCertificateRevocationList = true; to do that and it works fine in a setup without a proxy. With proxy, we get the following error:

Could not establish trust relationship for the SSL/TLS secure channel.

Servers CRL file is accessible via IE in same setup.

I have looked around, but found nothing.

Solution

  • So basically, I found the answer through experimentation.

    If you want your CRL to work via proxy:

    1. you might want to setup proxy for connections your application does (we had that already, so it was not really a problem).
    2. you need to set netsh winhttp proxy, to point to your proxy (use set proxy myproxy:proxyport in netsh winhttp console)