CRL URL parsing not correct?

[andrasg]

The CRL attribute on certs in my environment is in a format <URL> (<URL-encoded URL>). Looks like the script does not parse this correctly, and fails on download:

Is my CRL attribute in the wrong format or is this a script parsing problem?

[onpremcloudguy]

Hi Andras, That looks like an issue with where the CRL is hosted on the I assume azure blob can’t be found, maybe check where the cname for the crl is redirecting and confirm it is still online. But also look at Windows Hello for Business Cloud Trust, as it simplifies the certificate requirements for Windows Hello for Business, we talk about it on the podcast here: https://youtu.be/q0Y4g0dcOY4 Thanks Steven From: Andras Gaal ***@***.***> Sent: Wednesday, September 21, 2022 11:21 PM To: onpremcloudguy/WHfBChecks ***@***.***> Cc: Subscribed ***@***.***> Subject: [onpremcloudguy/WHfBChecks] CRL URL parsing not correct? (Issue #12) The CRL attribute on certs in my environment is in a format URL (URL). Looks like the script does not parse this correctly, and fails on download: [image]<https://user-images.githubusercontent.com/10730249/191514561-c2384333-084e-42ee-86ee-cf43dd382382.png> Is my CRL attribute in the wrong format or is this a script parsing problem? — Reply to this email directly, view it on GitHub<#12>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AGUWFIE4LZ6KPK7XSBMN74LV7MDSXANCNFSM6AAAAAAQSCDF2I>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.******@***.***>>

[bservet]

Hi,

I also get this error message about the blob not existing. But when I paste the URL (as shown in powershell) in the browser the crl is downloaded successfully...?

Both the check and the download where done from the same computer.

Thanks

PS Windows Hello for Business Cloud Trust looks promising!

[andrasg]

Hi Andras, That looks like an issue with where the CRL is hosted on the I assume azure blob can’t be found, maybe check where the cname for the crl is redirecting and confirm it is still online.

Hey, the blob can be found, no issue with that. The thing is that I have spaces in the name of the CA, therefore the CRL url is in this format: CRLUrl (CRLURLbutescaped). If the URL does not contain any special characters, the part in parentheses will not be in the CRL field.

Cloudtrust works already in my POC :)