OK, so this is going to be geeky and I wouldn\u2019t normally post stuff like this to my Facebook page but for various reasons I can\u2019t post to my blog right now and I want to capture this somewhere.<\/p>\n
So in Windows there are several services related to the cryptography, certificates and smartcards; services are able to perform actions for the user and system in the background and enable application developers to do things in a least-privileged way.<\/p>\n
One of the core services in these scenarios is the \u201cCryptographic Services\u201d service; it does a bunch of things including the wire retrievals for CryptoAPI.<\/p>\n
Specifically it is the worker for CryptRetrieveObjectByUrl which is used by Windows and other applications to gather evidence necessary to validate certificates, such evidence includes intermediate certificates, CRLs, OCSP responses and a file called commonly referred to as the Windows Certificate Trust List.<\/p>\n
This API (at least in Windows 7) maintains a single cache for the whole system of the objects it has downloaded.<\/p>\n
These files are kept in a hidden system folder called CryptNetUrlCache, in some cases you may want to test a scenario without relying on the cache, to do that you must flush the cache. The easiest way to do that is to open an administrative command prompt and run the following commands:<\/p>\n
cd %WINDIR%\\ServiceProfiles\\LocalService\\AppData\\LocalLow\\Microsoft\\CryptNetUrlCache<\/p>\n
attrib .\\Content\\*.* -s<\/p>\n
del .\\Content\\*.*<\/p>\n
attrib .\\MetaData\\*.* -s<\/p>\n
del .\\MetaData\\*.*<\/p>\n
<\/p>\n
%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache<\/p>\n
attrib .\\Content\\*.* -s<\/p>\n
del .\\Content\\*.*<\/p>\n
attrib .\\MetaData\\*.* -s<\/p>\n
del .\\MetaData\\*.*
\n%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache<\/p>\n
attrib .\\Content\\*.* -s<\/p>\n
del .\\Content\\*.*<\/p>\n
attrib .\\MetaData\\*.* -s<\/p>\n
del .\\MetaData\\*.*
\n%WINDIR%\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache<\/p>\n
attrib .\\Content\\*.* -s<\/p>\n
del .\\Content\\*.*<\/p>\n
attrib .\\MetaData\\*.* -s<\/p>\n
del .\\MetaData\\*.*<\/p>\n
<\/p>\n
Alternatively\u00a0you can call this command:<\/p>\n
certutil -URLcache * delete<\/p>\n
<\/p>\n
No reboot is necessary, next time a component calls the CryptRetrieveObjectByUrl API it will not be able to satisfy that request with the cached data and will be forced to go on the wire.<\/p>\n
One of the functions the service offers is the Automatic Update of the root store, a way to validate the cache is not being used is to:<\/p>\n
Since every time a root is added a new event log entry is created you will see something that says \u201cSuccessful auto update of third-party root certificate\u201d in the event log, you will also see a few files in the above directories you previously cleared.<\/p>\n
This all tells you that new wire retrieval took place and that the cache was not used.<\/p>\n
You can of course also use tools like Reg\/FileMon as well as Network Monitors to infer much of the same.<\/p>\n
<\/p>\n
Hope this helps someone someday,<\/p>\n
Ryan<\/p>\n","protected":false},"excerpt":{"rendered":"
OK, so this is going to be geeky and I wouldn\u2019t normally post stuff like this to my Facebook page but for various reasons I can\u2019t post to my blog right now and I want to capture this somewhere. So in Windows there are several services related to the cryptography, certificates and smartcards; services are […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[12],"tags":[17,6,19],"class_list":["post-23","post","type-post","status-publish","format-standard","hentry","category-programming","tag-microsoft","tag-ssl","tag-x509"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/23","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=23"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/23\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}