What exactly is Windows 7 trying to check? And why would downloading a root certificate update help with this (presumably the "checking" would still continue?) Unless you are saying that the root cert that signed the top of the trust chain isn't in the Windows 7 trusted root certificates store. In which case you should be getting warnings in your browser.
In any case, do you have the entire certificate chain installed on your IIS server? IE (with IIS) has the ability to download all intermediate certificates that chain back to a trusted root certificate. So you only need the root cert in the Windows client store, and all other certs on IIS, and everything will happen automatically for you in the background. Cheers Ken From: James Hill [mailto:[email protected]] Sent: Monday, 13 September 2010 9:24 AM To: NT System Admin Issues Subject: Certs, wuauclt.exe, proxy, firewall, winhttp, laptops....arrr the pain! Problem: OWA is very slow to display the login screen on Win 7 clients only. Once logged in it performs as expected unless left untouched for a set period of time... then it is slow again on the first request (open message, forward...whatever). Troubleshooting: All sorts of stuff but ended up with Wireshark and a bit of packet sniffing. Noticed that when browsing to https://owa.blah it is attempting to contact some external IP's. Result: Firewall says NO. Why: Certificate (issued by Digicert) recently updated on exchange server for OWA. Win 7 seems to want to check it. Win XP doesn't, presumably as it's Cert's are up to date thanks to SCCM/WSUS. More Problems: There are no root cert updates via WSUS for Win 7. Win 7 attempts to update certs itself directly with Microsoft. Firewall says NO. We have a proxy server. Win 7 uses wuauclt.exe to auto update certs. Wuaclt.exe ignores proxy settings. Possible but unpleasant solutions: Allow traffic to windowsupdate.com and .microsoft.com through firewall (unpleasant for many reasons including firewall wants IP's not domain names). Use netsh winhttp to set proxy (unpleasant as it will break internet access for laptops that roam outside our network. We currently use a proxy.pac to handle this and laptop users like that it just works) Export required root cert from a working machine and import into the rest (unpleasant as it only fixes this one app. What about other certs in the future?) I'll probably have to go with the export/import root cert. Haven't actually tested that yet though. Why couldn't MS allow wuaclt to follow proxy settings in IE? That's a fairly standard thing for many apps. Or why can't they provide cert updates via WSUS for Win 7? It probably sounds like I'm being overly fussy but that's pretty normal for me. If anyone can think of a nice solution I'd love to hear it. Otherwise I hope I've alerted others to potential issues that may arise for them in the future. James. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
