Resolving Delta CRL problems on Windows Server 2008 based web servers

If you are running a Windows Server 2008 web server for CRL publishing purposes, you should be aware of the fact that Windows Server 2008 (or IIS 7.0 to be more specific) does not allow URL’s with plus signs by default. Delta CRL’s are using a plus sign in the filename to indicate that they are a Delta CRL of the Base CRL with the same name but without a plus sign in the filename.

If you are hosting your CRL’s in the default website on a IIS 7.0 on Windows Server 2008, you should run the following command in an elevated cmd prompt to be able to allow IIS to make your Delta CRL’s accessible. If you are publishing them in another IIS site, customize the site name in the command to your site.

%windir%\system32\inetsrv\appcmd set config "Default Web Site" -section:system.webServer/security/requestFiltering -allowDoubleEscaping:true

UPDATE: Shay Levy was kind enough to provide the PS equivalent below. Thanks a lot!

Set-WebConfiguration -Filter system.webServer/security/requestFiltering -PSPath ‘IIS:\sites\Default Web Site’ -Value @{allowDoubleEscaping=$true}

// Fredrik “DXter” Jonsson