CAPI2 The Proxy Auto-configuration URL was not found - asp.net

Question

I have a asp.net mvc application. running on windows server 2008 R2 and framework 4.5.
On one controller. I use httpclient post xml to remote soap server via https channel. but very slow. it take 6 seconds to finish the request. I enable CAPI2 log. found error:
> System
>
> - Provider
>
> [ Name] Microsoft-Windows-CAPI2
> [ Guid] {5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}
>
> EventID 53
>
> Version 0
>
> Level 2
>
> Task 53
>
> Opcode 2
>
> Keywords 0x4000000000000036
>
> - TimeCreated
>
> [ SystemTime] 2013-03-06T00:09:12.342400000Z
>
> EventRecordID 226
>
> Correlation
>
> - Execution
>
> [ ProcessID] 4716
> [ ThreadID] 3620
>
> Channel Microsoft-Windows-CAPI2/Operational
>
> Computer WIN-PFVACQLB4A9
>
> - Security
>
> [ UserID] S-1-5-82-100694679-852442941-408577778-1461352480-452402374
>
>
>- UserData
>
> - CryptRetrieveObjectByUrlWire
>
> - URL http://gtssldv-aia.geotrust.com/gtssldv.crt
>
> [ scheme] http
>
> - Object
>
> [ type] CONTEXT_OID_CERTIFICATE
> [ constant] 1
>
> Timeout PT15S
>
> - Flags
>
> [ value] 286005
> [ CRYPT_RETRIEVE_MULTIPLE_OBJECTS] true
> [ CRYPT_WIRE_ONLY_RETRIEVAL] true
> [ CRYPT_LDAP_SCOPE_BASE_ONLY_RETRIEVAL] true
> [ CRYPT_OFFLINE_CHECK_RETRIEVAL] true
> [ CRYPT_AIA_RETRIEVAL] true
> [ CRYPT_PROXY_CACHE_RETRIEVAL] true
>
> - AuxInfo
>
> [ maxUrlRetrievalByteCount] 100000
> [ fProxyCacheRetrieval] true
>
> - AdditionalInfo
>
> - NetworkConnectivityStatus
>
> [ value] 1
> [ _SENSAPI_NETWORK_ALIVE_LAN] true
>
> - Action
>
> [ name] Call_WinHttpGetProxyForUrl
> - Error The Proxy Auto-configuration URL was not found.
>
> [ value] 2F94
>
>
> - Action
>
> [ name] NoProxy
>
> - Action
>
> [ name] Call_WinHttpGetProxyForUrl
> + Error The Proxy Auto-configuration URL was not found.
>
> [ value] 2F94
>
>
> - Action
>
> [ name] NoProxy
>
> - HTTPRequestHeadersInfo
>
> Header GET /gtssldv.crt HTTP/1.1
>
> Header Accept: */*
>
> Header User-Agent: Microsoft-CryptoAPI/6.1
>
> Header Connection: Keep-Alive
>
>
> - HTTPResponseHeadersInfo
>
> Header HTTP/1.0 200 OK
>
> Header Connection: Keep-Alive
>
> Header Date: Tue, 05 Mar 2013 23:43:39 GMT
>
> Header Via: NS-248
>
> Header Via: 1.0 hostname:80 (squid/2.6.STABLE21)
>
> Header Content-Length: 1022
>
> Header Content-Type: text/plain
>
> Header Last-Modified: Wed, 21 Jul 2010 18:25:03 GMT
>
> Header Accept-Ranges: bytes
>
> Header Age: 540
>
> Header ETag: "25f7fb-3fe-48be9eb969dc0"
>
> Header Server: Apache/2.2.3 (Red Hat)
>
> Header X-Pad: avoid browser bug
>
> Header X-Cache: MISS from hostname
>
> Header X-Cache-Lookup: HIT from hostname:80
>
>
> - Action
>
> [ name] WriteToCache
> - Error The system cannot find the file specified.
>
> [ value] 80070002
>
>
>
> - CacheInfo
>
> [ lastSyncTime] 2013-03-06T00:09:12.342Z
> - URLCacheResponseInfo
>
> [ responseType] CRYPTNET_URL_CACHE_RESPONSE_HTTP
> [ lastModifiedTime] 2010-07-21T18:25:03Z
> [ eTag] "25f7fb-3fe-48be9eb969dc0"
> [ proxyId] DEAE4085
>
>
> - RetrievedObjects
>
> - Certificate
>
> [ fileRef] BAE30B15DBB1544CF194D076B75B7BB9E3D6B760.cer
> [ subjectName] GeoTrust DV SSL CA
>
>
> - EventAuxInfo
>
> [ ProcessName] w3wp.exe
>
> - CorrelationAuxInfo
>
> [ TaskId] {2B4FC750-01D1-4D7E-BEEF-A3F9DD09B0E8}
> [ SeqNumber] 4
>
> - Result
>
> [ value] 0
I also unchecked Internet Exploer->Internet Opitions->Connections->LAN Settings-> Automatically detect settings. nothing change.
Looking for help.
Thanks

Answer 1

Probably it's too late but the way I solved the same exact problem was to find the user ID, in your case:
[ UserID] S-1-5-82-100694679-852442941-408577778-1461352480-452402374
inside the registry, in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList .
It will tell you which user is invoking the Crypto API 2 (CAPI2), in my case was "Classic .NET Application Pool" or similar.
I fixed it by impersonating (running the process as another user with enough rights), then I did not have anymore this write errors and therefore not the red error messages in the event log.
For this, I have created an user with administrator rights in the local computer (I know it is not the most secure option, but I had to try, and it worked). In the end, seemed that the problem was the proxy but was that particular error:.
> [ name] WriteToCache
> - Error The system cannot find the file specified.
>
> [ value] 80070002
>
It had no write rights somewhere, but the Administrator does :P
Also another thing I did (as the crypto API were requesting always the CRL), in the Local Group Policy Editor, following the path:
Computer Configuration > Windows Settings > Security Settings > Public Keys > Certificate Path Validation Settings > "Revocation" tab. Enable "Define these policy settings" and also enable "Allow CRL and OCSP responses to be valid longer than their lifetime".
Then I extended the validity of this CRL into one year (8760 hours), I know it is also too long, but it depends on your needs or security concerns, in my case is safe enough.
I hope it helps you out

Answer 2

My answer is taken from here: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/82c52c69-1a53-4f48-8c7e-37bc7364dca3/
Setup an IIS server such that it would respond with javascript inside http://wpad.mylab.local/wpad.dat - don't forget to add the MIME type for wpad.dat (application/x-javascript is fine). If you don't have the need for a proxy, then the javascript in your wpad.dat file should look like the following:
function FindProxyForURL(url, host)
{
return "DIRECT";
}
After that, you should no longer have event 53 in the CAPI2 logs when using certutil.