Question: difference between X509RevocationMode.Offline and X509RevocationMode.Online

[heng-liu]

Issue NuGet/Home#11548 says setting NUGET_CERT_REVOCATION_MODE to offline makes the restore much faster on windows (from 5m 39s to 1m 22s)
The only difference from NuGet side is the value of X509RevocationMode(online to offline), which is set before chain building.
From the doc, we can see the difference between offline and online is:
Offline: A revocation check is made using a cached certificate revocation list (CRL).
Online: A revocation check is made using an online certificate revocation list (CRL).

May I know if there is any other difference(e.g. OCSP )between the two modes? Just wonder why there is a big difference in restore time.

From the doc, there is a note
Specifying an online check can result in a long delay while the certificate authority is contacted.
May I know if you've done any test comparing the two mode? Thanks!

[ghost]

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Issue NuGet/Home#11548 says setting NUGET_CERT_REVOCATION_MODE to offline makes the restore much faster on windows (from 5m 39s to 1m 22s)
The only difference from NuGet side is the value of X509RevocationMode(online to offline), which is set before chain building.
From the doc, we can see the difference between offline and online is:
Offline: A revocation check is made using a cached certificate revocation list (CRL).
Online: A revocation check is made using an online certificate revocation list (CRL).

May I know if there is any other difference(e.g. OCSP )between the two modes? Just wonder why there is a big difference in restore time.

From the doc, there is a note
Specifying an online check can result in a long delay while the certificate authority is contacted.
May I know if you've done any test comparing the two mode? Thanks!

Author:	heng-liu
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[heng-liu]

cc @loic-sharma @JonDouglas @nkolev92

[bartonjs]

The behavioral differences come from the Windows OS, they're a black box to .NET. When the mode is Offline we set the CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY flag when calling CertGetCertificateChain.

In Online mode the OS might prefer to check live OCSP over using a longer-lifed cached CRL, but that's speculation.

[heng-liu]

Thanks @bartonjs !
We're considering checking the time spend on chain building, and see if the most time consuming chain buildings have some certificate in common, so that we could locate the problematic certificate if there is any.
But my concern is, if the problem is caused by anything else(not certificate related), e.g. the first call failed if PKI isn't setup correctly, or CRL caching is slow, we will not be able to know any of this, as we only have the time spend on the whole chain building, and there is no more granular data for us to investigate.
So I'm wondering if you have any suggestions, or any referral of experts might know how to investigate this. Thanks!

[bartonjs]

Windows has telemetry for chain building, which is opt-in. The instructions for turning it on are at https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10)?redirectedfrom=MSDN