I think there might be a bug with current branch 2107 SCCM client and would like to bring up my findings.
We have had a CMG running just fine for ages now, and we started noticing connection issues to the CMG after clients had upgraded to v 5.00.9058.1018.
The clients are failing to connect to the CMG because they are trying to check the CRL for the SSL certs. In SCCM there are TWO places where CRL checking is specified, on the site communication Security tab, and on the CMG properties itself. What is happening is that this latest build is TOTALLY ignoring the setting to NOT check CRL when connected to the CMG, and packet tracing shows that this build of client is trying to reach our internal PKI CRL when the client is on the INTERNET. Everything was fine until this client build, so something has changed. I can see in the CCMMessaging log the client attempting to use the CRL with "Enabled SSL Revocation check" in the log, then it fails of course eventually with "WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED is set".
If we disable ALL CRL checking in the main site communication security tab (when I put the client on VPN so it can reach the servers), refresh the policy, then put it on the internet again, it fixes the issue and does not try and use the internal CRL for the CMG.
Can someone at MS take a look at this? Before we upgraded to 2107, the clients were using INTERNAL CRL checking no problem when on the intranet, but when outside on the internet, respected the CMG "verify client certificate revocation" and things worked fine. (crl checking when on prem, no crl checking when on cmg)
It has taken me about 1 week to troubleshoot this, and has caused us all sorts of issues!
