WSA removes CRL information in certificate.

[FredrikW73]

Our WSA-proxy performs TLS-decryption for End-User Notification. 
If a user tries to visit a webpage in a forbidden URL category (not permitted by policy) then a block message is shown. 
If the user uses Firefox or Google Chrome then everything works as intended. 
If the user however uses Microsoft Edge then he will get a certificate warning complaining that there is no information
regarding revocation checks:  "NET::ERR_CERT_NO_REVOCATION_MECHANISM".

I understand that this is because the WSA removes CRL info from the certificate. 
Firefox and Google Chrome don´t mind this but Microsoft Edge complains.
Is there a way to configure the WSA to include info about a revocation mechanism for the temporary certificates it generates?

As it is now, TLS-decryption is not usable for Microsoft Edge users in our network (i.e. 95 % of all users).

[amojarra]

Hi @FredrikW73 

WSA uses OCSP to do certificate revocation .

Online Certificate Status Protocol (OCSP). The Web Security appliance checks the revocation status with the issuing certificate authority in real time. If the issuing certificate authority supports OCSP, the certificate will include a URL for real-time status checking. This feature is enabled by default for fresh installations and disabled by default for updates

Previously there were some issue with older versions of Google chrome, they did not support OCSP. 

you can check if it is Enabled in your Edge due to your organizations policies:

kindly check this link please : Microsoft Edge Browser Policy Documentation | Microsoft Docs

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[FredrikW73]

I activated the OCSP check in the WSA proxy. Maybe the proxy verifies the server certificate, checking
for revocation status, but no info about revocation mechanisms is included in the decryption certificate
passed down to the client.

Microsoft Edge still do not accept the certificate for web page created by the proxy.

Below is an example of me trying to visit a web page in a blocked URL category.
The certificate created by the proxy for the notification is not accepted by Edge
browser since information about CRLs and such is missing.

Should have been a block page