CertCheckMode
The CertCheckMode property enables or disables Certificate Revocation List (CRL) checking. When CertCheckMode is set to a value greater than 0 (CertCheckMode>0), the CRL does not search for certificates that have been revoked. When CertCheckMode is equal to 0 (CertCheckMode=0), the CRL searches for certificates that have been revoked.
Schema Attributes
Attribute Name |
Value |
|---|---|
DWORD |
|
DWORD_METADATA |
|
0 |
|
Not specified. |
|
0 |
|
Not specified |
|
2160 |
|
No friendly named is defined for this identifier in iiscfng.h. Use the Internal ID attribute listed above. |
|
INHERIT |
|
IIS_MD_UT_SERVER |
Configurable Locations
You can configure this property at the following locations in the IIS metabase.
Metabase Path |
IIS Admin Object Type |
|---|---|
/LM/W3SVC |
IIsWebService |
/LM/W3SVC/n |
IIsWebServer |
Flags
Flag Name |
MD_CERT_NO_REVOC_CHECK |
|---|---|
Versions Applicable |
[IIS 5.0][IIS 5.1][IIS 6.0] |
Description |
When MD_CERT_NO_REVOC_CHECK is set to true, certificate revocation is not performed. |
1 (hex 0x00000001) |
|
MD_CERT_NO_REVOC_CHECK |
|
None specified. |
Flag Name |
MD_CERT_CACHE_RETRIEVAL_ONLY |
|---|---|
Versions Applicable |
[IIS 5.0][IIS 5.1][IIS 6.0] |
Description |
When MD_CERT_CACHE_RETRIEVAL_ONLY is set to true, the CRL will not be updated from a remote location, such as a CRL URL location, during a certificate revocation verification. In this case, the CRL that is cached on the client is used. If the CRL is expired, the certificate revocation verification fails. |
2 (hex 0x00000002) |
|
MD_CERT_CACHE_RETRIEVAL_ONLY |
|
None specified. |
Flag Name |
MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME |
|---|---|
Versions Applicable |
[IIS 5.0][IIS 5.1][IIS 6.0] |
Description |
When MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME is set to true, the client CRL is replaced by the remote CRL, even if the CRL that is cached on the client is valid. The value of the RevocationFreshnessTime property is used as a counter, which determines the frequency of this action. |
4 (hex 0x00000004) |
|
MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME |
|
None specified. |
Flag Name |
MD_CERT_NO_USAGE_CHECK |
|---|---|
Versions Applicable |
[IIS 5.0][IIS 5.1][IIS 6.0] |
Description |
When MD_CERT_NO_USAGE_CHECK is set to true, the certificate provided by the client is not verified as valid. |
65536 (hex 0x00010000) |
|
MD_CERT_NO_USAGE_CHECK |
|
None specified. |
Requirements
Client: Requires Windows XP Professional, Windows 2000 Professional, or Windows NT Workstation 4.0.
Server: Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server 4.0.
Product: IIS
See Also
Concepts
Comparison of IIS Administration Features