|SeanGrossell||An Error Occurred While verifying the certificate the Secunia CSI cannot continue execution|
|5th Jul, 2013 13:39|
User Since: 5th Jul, 2013
System Score: N/A
Last edited on 5th Jul, 2013 14:23
|Post CSI 6.0 Uninstall. A subsequent CSI 6.0 install results in this error,|
|r.danailov||RE: An Error Occurred While verifying the certificate the Secunia CSI cannot continue execution|
|9th Jul, 2013 09:09|
User Since: 3rd Jan 2012
System Score: N/A
Location: Copenhagen, DK
Last edited on 9th Jul, 2013 09:23
This error is caused by insufficient 'CRL Validation Path' settings implemented by Microsoft by default in your domain.
The main setting that causes this behavior is within IE Internet Options > Advanced > Security > 'Check for publishers' certificate revocation' (or server revocation if CSI is on a server OS).
When CSI attempts a connection via the IE, the latter is supposed to verify the security certificate of the console. However, since Microsoft enabled by default maximum time for CRL Validation to be 15 seconds, while the actual process usually takes 30-40 secs, the connection times out.
After it times out, the IE remains in state to have not verified the CSI security certificate and therefore disallows the CSI to proceed with connecting successfully to Secunia Cloud. This causes the popup error you experienced.
1. In one of many attempts, the IE may succeed to verify the security certificate and further it will allow CSI the connection. You could try starting CSI few times throughout the day to see if this would work out well at least once. After being verified, the certificate is cached locally and the issue would not re-occur anymore.
2. You could extend the CRL Validation Time via GPO setting. Should you want to do it only for the local machine, you could modify the Local Security Policy accordingly as follows:
a) Open Start > type 'gpedit.msc' in the Search field > Enter the gpedit.msc console
b) Browse to Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Certificate Path Validation Settings. Enter this setting and select the 'Network Retrieval' tab.
c) Tick 'Define these policy settings' and then increase the time for 'Default URL Retrieval timeout' from 15 sec to 30-40 seconds.
d) Save changes and retry launching the CSI.
Please note that the IE may be caching, so if you experience the error quite fast (1-2 secs), this would mean that your IE didn't really retried it only returned a cached error. You could open CMD and execute the command 'certutil -urlcache crl delete' to clean the cache and then you can retry again. The CSI must take some time between 15-30 secs before it does anything. This is your indication that you are on the right track.
Let us know if my instructions helped you resolve the issue.
Kind regards / Stay Secure
Rosen Danailov | Junior Solution Specialist
Secunia Customer Support
Not a customer already?
Learn more about how our market leading Vulnerability Management solutions can help you manage risk and ensure compliance.