Setting up a leaf server certificate validation for Kiwi Syslog Server (Secure TCP) working without Internet (offline / no CRL access)

When .NET validates a certificate chain, it attempts to download CRL (Certificate Revocation List) and perform OCSP checks against your CA's online endpoints. If there is no internet access, this times out and can cause connection failures.

Add a CRL to a storage (Air-gapped / No Internet)

If the system has no internet access, CRLs can be imported manually.
Note. All URLs and file names in this guide are real, but used as examples, so you might have similar or different ones.

1. Gather the required information
   First of all, you need to get a dump of your certificate to fetch the required CRL URLs from it. Do it on the machine that has internet access.
   Open PowerShell and run this command:

certutil -verify -urlfetch %full_path_to_your_crt_file%

You will see a lot of certificate information where you should be looking for these 2 particular sections: 

---------------- Certificate CDP ---------------- 
Verified "Base CRL (0848)"
Time: 0 59311acb23b0da67a5271fc7c75304163d47c139 
[0.0] http://crl3.digicert.com/DigiCertEVRSACAG2.crlVerified "Base CRL (0848)"
Time: 0 59311acb23b0da67a5271fc7c75304163d47c139 
[1.0] http://crl4.digicert.com/DigiCertEVRSACAG2.crl---------------- Certificate CDP ---------------- 
Verified "Base CRL (02f5)"
Time: 0 bf807f842984a51cc5d0afc39e960df4f2b5c93f
[0.0] http://crl3.digicert.com/DigiCertGlobalRootG2.crlVerified "Base CRL (02f5)"
Time: 0 bf807f842984a51cc5d0afc39e960df4f2b5c93f
[1.0] http://crl4.digicert.com/DigiCertGlobalRootG2.crl

Commonly, you will need to fetch 4 URLs (depends on how many of them certificate has, but usually it’s 4).
We’re interested in RSA and root CRLs.
Why do you need both RSA and root CRLs?
Because we’re dealing with a certificate chain, not a single certificate.

2. Download CRL (on internet-connected machine)
   Now, when you have all the required URLs for the certificate’s CRLs, simply paste them into the browser’s URL space and download all of them.
3. Copy files to an offline machine by any means, USB, flash drive, shared folder, etc.
   It doesn’t matter where you put them, just be sure you know where they are.
4. Switch to an offline machine and clear the URL cache
   Open PowerShell on an offline machine and execute this command:

certutil -urlcache * delete

5. Add CRLs to a storage
   Now we need to add all 4 copied .crl files to a certificate storage which later will be used for a chain validation of a leaf server certificate.
   In PowerShell, execute a command on all 4 .crl files:

certutil -addstore CA %full_path_to_your_crl_file%

6. Refresh the cache of a chain engine
   To do that, in PowerShell, execute command:

certutil -setreg chain\ChainCacheResyncFiletime @now

7. Verify a certificate
   In PowerShell, execute the command:

certutil -verify %full_path_to_your_crt_file%

You should see a successful output like this:

”Leaf certificate revocation check passed” means that you’ve done everything correctly and your leaf server certificate has been successfully verified.