Ok after some more investigation the win 7 clients appear to be checking whether the cert is legit (revoked etc.) via OCSP. I can see traffic attempting to get to ocsp.entrust.net
There is also some comments from a Digicert tech here http://social.technet.microsoft.com/Forums/en/exchange2010/thread/299c8ebe-223c-43ab-8cbc-c8221991813a Whilst that forum topic is about installing the cert on the exchange server it would appear that Win 7 clients also check on the cert status. The clients need access to check the cert/s. It's also per user profile! There was mention of winhttp following the info in a published .pac file. We have ours stored locally so I will look at setting up auto proxy config using a .pac and see if that works. From: James Hill Sent: Monday, 13 September 2010 11:44 AM To: NT System Admin Issues Subject: RE: Certs, wuauclt.exe, proxy, firewall, winhttp, laptops....arrr the pain! Thanks for shedding some light on this. I've spent too long on it and wasn't thinking clearly. The root cert must be ok as there are no errors/warnings. If I allow a win 7 pc direct access to the net owa opens instantly. If I then remove that direct access owa continues to work correctly. So it is updating/checking something but I don't know what. I think I will have a look at the digicert site to see if I have a cert with some magic I'm not aware of. From: Ken Schaefer [mailto:[email protected]] Sent: Monday, 13 September 2010 11:36 AM To: NT System Admin Issues Subject: RE: Certs, wuauclt.exe, proxy, firewall, winhttp, laptops....arrr the pain! What exactly is Windows 7 trying to check? And why would downloading a root certificate update help with this (presumably the "checking" would still continue?) Unless you are saying that the root cert that signed the top of the trust chain isn't in the Windows 7 trusted root certificates store. In which case you should be getting warnings in your browser. In any case, do you have the entire certificate chain installed on your IIS server? IE (with IIS) has the ability to download all intermediate certificates that chain back to a trusted root certificate. So you only need the root cert in the Windows client store, and all other certs on IIS, and everything will happen automatically for you in the background. Cheers Ken From: James Hill [mailto:[email protected]] Sent: Monday, 13 September 2010 9:24 AM To: NT System Admin Issues Subject: Certs, wuauclt.exe, proxy, firewall, winhttp, laptops....arrr the pain! Problem: OWA is very slow to display the login screen on Win 7 clients only. Once logged in it performs as expected unless left untouched for a set period of time... then it is slow again on the first request (open message, forward...whatever). Troubleshooting: All sorts of stuff but ended up with Wireshark and a bit of packet sniffing. Noticed that when browsing to https://owa.blah it is attempting to contact some external IP's. Result: Firewall says NO. Why: Certificate (issued by Digicert) recently updated on exchange server for OWA. Win 7 seems to want to check it. Win XP doesn't, presumably as it's Cert's are up to date thanks to SCCM/WSUS. More Problems: There are no root cert updates via WSUS for Win 7. Win 7 attempts to update certs itself directly with Microsoft. Firewall says NO. We have a proxy server. Win 7 uses wuauclt.exe to auto update certs. Wuaclt.exe ignores proxy settings. Possible but unpleasant solutions: Allow traffic to windowsupdate.com and .microsoft.com through firewall (unpleasant for many reasons including firewall wants IP's not domain names). Use netsh winhttp to set proxy (unpleasant as it will break internet access for laptops that roam outside our network. We currently use a proxy.pac to handle this and laptop users like that it just works) Export required root cert from a working machine and import into the rest (unpleasant as it only fixes this one app. What about other certs in the future?) I'll probably have to go with the export/import root cert. Haven't actually tested that yet though. Why couldn't MS allow wuaclt to follow proxy settings in IE? That's a fairly standard thing for many apps. Or why can't they provide cert updates via WSUS for Win 7? It probably sounds like I'm being overly fussy but that's pretty normal for me. If anyone can think of a nice solution I'd love to hear it. Otherwise I hope I've alerted others to potential issues that may arise for them in the future. James. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
