SSTP Windows VPN Client Error: The revocation function was unable to check revocation

If you are deploying SSTP VPN for Windows clients and get the error: "The revocation function was unable to check revocation because the revocation server was offline.", you are most likely using your own internal PKI and the certificate used for SSTP does not have a Certificate Revocation List (CRL) accessible from the outside, so the client machine is failing checking whether or not the certificate has been revoked from the CA. If you simply want to bypass this, you can edit the registry on the client:

Disable CRL Checking on VPN Client

  1. Start Registry Editor (Regedit.exe)
  2. Locate and then click the following key in the registry:
    HKEY_LOCAL_MACHINE–>System->CurrentControlSet->Services->Sstpsvc->Parameters
  3. On the Edit menu, point to New , click DWORD (32-bit) Value, and then add the following registry value:
    Value Name: NoCertRevocationCheck
    Value Data: 1

In  the following video I setup SSTP VPN almost from scratch in about 10 minutes. I did run into a snag while Windows complained about a CN (common name) mismatch while it was actually a Subject Alternative Name DNS mismatch, not CN. I inadvertently proved that SSTP relies on the SAN name in the certificate. After 41 years of being in business they still don't get their error messages right.

If you're wondering why I'm specifying port 444 instead of leaving the port blank or entering 443, I'm performing port translation on the firewall since I'm already using https for something else.

Source:
sysadminshowto.com for the NoCertRevocationCheck reg string

Share
Disqus Comments Loading...

Recent Posts

VMWare vSphere 6.7 ESXTOP Output Garbled

If your VMWare vSphere 6.x environment command output of esxtop looks like a bunch of garbled gibberish (it's actually CSV… Read More

February 28, 2019 7:39 pm 19:39

How To Run RoboCopy Backup in Parallel

From time to time Windows Admins will surprise you with band-aid and bubble gum scripts, that's entirely expected I think.… Read More

February 28, 2019 12:20 pm 12:20

Windows 10 GodMode - The Ultimate Administrator Shortcut

Have you ever wondered what life might be like if the Windows 10 OS somehow had a single folder that… Read More

February 28, 2019 7:58 am 07:58

Samsung Galaxy S9 G960/G965 Stock ROM Firmware Download

There could be any number of reasons for needing to flash manufacturer stock OEM firmware on a Samsung Galaxy S9… Read More

January 24, 2019 7:42 am 07:42

Output IP Address with ipconfig Findstr Ethernet Adapter

How many times have you entered  ipconfig /all at the command line to return a single IP address, then have to strain… Read More

January 20, 2019 12:39 am 00:39

AWS SES Assistance in Enterprise Market - A Must Read

Designing e-mail solutions on a large scale can be a complex and costly challenge for a business: you need to… Read More

December 25, 2018 4:01 pm 16:01