Unable to check revocation status

Hello,

This is because your internal CA is a not a trusted top-level CA. This sensor will work correctly with self-signed or certs issued by an internal CA. You must use it with a cert you purchase from a certificate authority.

Let me know if you have any questions.

Benjamin Day
[Paessler Support]

Hello Benjamin,

so you are telling the sensor does not work like everyone would expect and check the CRL statet in the certificate? We have an non-public CA, which is trusted by the PRTG Core (Channel Root Authority truested is Yes). But the sensor refuses to check the CRL stated within the certificate because it is not a paid/public CA?! Where is the difference between public CA and non-public CA for the sensor? It could also be a paid CA which is not public. Like Telekom Trusted Business CA. How does the sensor know if the CA is paid??

Max

Max,

The main reason being that we cannot validate a Root CA within an organization. Our sensor relies on 3rd parties for certificate validation, and signature validation. Unfortunately, we do not have a sensor that can take into account local root CAs at this time. You can request this as a feature request by following the link below.

https://kb.paessler.com/en/topic/79245-how-can-i-propose-new-features-or-sensors-for-prtg

Benjamin Day
[Paessler Support]

Hello Benjamin,

one question: how can i disable this channel on non-public certificates so the sensor is not in the warning state all the time?

Max

Max,

At this time, we do not have any means of disabling channels on sensors. However, you can remove the channel's ability to alert. Click on the channel in question, and in the Channel Settings set the Lookup to none. This will remove that channel's ability to set the sensor status.

Benjamin Day
[Paessler Support]

Are there any news if this function is added since the last post? Is there a function request open for checking non-public CAs?

Kind regards Julian

Hello jkellermeier,

Thank you for the post, there's no change in regards to this, something else you could try is to create an EXE/XML sensor, however you need to have knowledge to create a script that checks this and returns a value to PRTG to just report either OK or Bad. Steps to create the the sensor: https://www.paessler.com/manuals/prtg/exe_script_sensor