Application / Certificate Performance Issues with Vista and FDCC

Summary

In the process of defining the FDCC image, the National Institute of Standards (NIST) included several Federal and DoD Root and Intermediate x509 certificates in the FDCC Vista Trusted Root and Intermediate Certification Authorities stores. Several of these certificates are cross-certified. When the Vista CryptoAPI (CAPI) is called by a process (e.g. Iexplore.exe validating a website’s SSL certificate), the CAPI chaining engine attempts to retrieve any certificate in the store cross-signing certificate. If the system is unable to reach the retrieval URL (stored in the certificate Subject Information Access extension) the CAPI chaining engine will timeout after 15 seconds. This can cause slow performance in applications that call the CAPI.

FDCC cross-certified Intermediate Certification Authorities store certificates

Symptoms

·         Connecting to SSL enable websites will take a long time or timeout.

·         Applications will be extremely slow and/or throw odd errors.

Cause

The VISTA CAPI chaining engine is unable to pull a cross-signing certificate. Each chaining attempt will timeout after 15 seconds. If the computer’s Intermediate Certification Authorities store contains multiple cross-signed certificates the CAPI-calling application will wait until all chaining attempts have succeeded or timed out. This can cause the application to pause for extremely long periods or produce odd errors.

Example

A laptop connecting via a modem using the Cisco VPN client will take ~14 minutes to call the modem dialer or produce the following error:

Secure VPN Connection terminated locally by the Client.

Reason 415: A required component PPPTool.exe is not present among the installed client software.

Connection terminated on: <date> Duration: <value>

Multiple errors are found within the CAPI2 event log. (to enable the CAPI2 eventlog start Eventvwr -> Application and Services Logs -> Microsoft -> Windows -> CAPI2 -> Operational -> right click Enable Log). The CAPI chaining engine cannot reach the URL because the system is unable to communicate to the Internet. Note that the “ProcessName” is cvpnd.exe which is the Cisco VPN service.

Note: The Cisco VPN client software requires the following certificate in the computer’s Trusted Root Certification Authorities store to establish a chain of trust (not included in the FDCC image, see Additional Information).

Version: 3

Serial Number: 01

Signature Algorithm:

    Algorithm ObjectId: 1.2.840.113549.1.1.4 md5RSA

    Algorithm Parameters:

    05 00

Issuer:

    E=premium-server@thawte.com

    CN=Thawte Premium Server CA

    OU=Certification Services Division

    O=Thawte Consulting cc

    L=Cape Town

    S=Western Cape

    C=ZA

NotBefore: 7/31/1996 8:00 PM

NotAfter: 12/31/2020 7:59 PM

Subject:

    E=premium-server@thawte.com

    CN=Thawte Premium Server CA

    OU=Certification Services Division

    O=Thawte Consulting cc

    L=Cape Town

    S=Western Cape

    C=ZA

Solutions

Method 1:

Microsoft is currently testing a hotfix to provide the ability to disable the cross-signed certificate chaining retrieval process. This hotfix is currently undergoing testing and is not publicly released. Microsoft Customers who have an Enterprise Agreement may obtain the hotfix through their Account Manager or Technical Account Manager (Premier contract holders). Reference number: KB Article Number(s): 955805

Method 2:

Enable the CAPI2 event log (Eventvwr -> Application and Services Logs -> Microsoft -> Windows -> CAPI2 -> Operational -> right click Enable Log) to determine which certificates the chaining engine cannot retrieve. Remove the certificate from the computer’s Intermediate Certification Authorities store.

Additional Information

FDCC settings disable Windows Updates ability to populate a computer’s Root Certification Authorities stores. FDCC compliant agencies will have to monitor and authorize certificates accordingly.

References

·         Certificates needed by Windows platforms:  http://support.microsoft.com/kb/293781

·         FDCC version 1.0 settings: http://nvd.nist.gov/fdcc/FDCC-Settings-major-version-1.0.xls

·         Microsoft Root Certificate Program: http://support.microsoft.com/kb/931125

·         Deploying Certificates via Group Policy: http://technet.microsoft.com/en-us/library/cc770315.aspx

·         RFC3280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile : http://www.ietf.org/rfc/rfc3280.txt

FDCC Blog Alert: Issue with Vista SP1

Author: Shelly Bird 

Credit:  Syed Ismail, Ben Christenbury

Applies to:  Vista SP1 alone.

Setting:

Microsoft Network Client: Digitally Sign communications (always) is set to Enabled in FDCC.

History:

The server side settings are always ON (w2k3 SP2):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters

                EnableSecuritySignature [REG_DWORD] = 0x1

                RequireSecuritySignature [REG_DWORD] = 0x1

Client-side settings (Vista SP1) for FDCC:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters

                EnableSecuritySignature [REG_DWORD] = 0x1

                RequireSecuritySignature [REG_DWORD] = 0x1

Issue:

Under this condition, GPO processing for the computer account fails, both at startup and every time gpupdate.exe is run.  There will be a 1058 error in Event Viewer:

3/19/2008          4:55:10 PM       1          0          1058     Microsoft-Windows-GroupPolicy            NT AUTHORITY\SYSTEM                        SDC-211.ITL.local         

The processing of Group Policy failed. Windows attempted to read the file \\ITL.local\SysVol\ITL.local\Policies\{1B71C87D-FAB7-4FE1-BEAF-07F846DE3E1D}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:  

a) Name Resolution/Network Connectivity to the current domain controller.  

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).  

c) The Distributed File System (DFS) client has been disabled. 

Detail: The account is not authorized to log in from this station

Result:  The Group Policy Engine is unable to get the GPO version from the DC.

As soon as RequireSecuritySignature is set to 0 (Disabled) on the client and the client is rebooted, GPO processing works fine.

Note that this issue does not happen in Vista Runtime (pre-SP1).  Previously, if the server and client were coordinated to be Enabled for this setting, no issues arose, except possibly with non-Microsoft SMB signing systems.

Resolution:  There is a QFE that can be requested from Microsoft Premier and which we have tested and confirmed eliminates this issue.  We highly recommend obtaining this QFE for any Vista SP1 implementations which are launched with the FDCC settings.  We hope it will shortly be available either as a public update or in the next Service Pack. 

FDCC and Internet Explorer 7, Part 1: Security Zones