I have a standalone machine that is running the Exchange 2010 Edge role. As part of this function, I need to assign a TLS certificate to the server. I am using the instructions provided here:
http://msexchangeguru.com/2012/07/24/edge-server-tls/
However, I am not able to overcome the revocation check failure despite following all the suggestions. I don't have a lot of experience with CA's, but to me it seems like the problem may be the certificate is only listing LDAP as the CRL, and a standalone (not domain joined) machine would not be able to query LDAP?
Here's the output from certutil.
Issuer:CN=rad-RAD-VMSRVRCA1-CA
DC=rad
DC=wustl
DC=edu
Subject:
CN=rad-vmsrvedge1.rad.wustl.edu
Cert Serial Number: 3fc1ee43000000000154
dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1)
dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2)
dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8)
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
Issuer: CN=rad-RAD-VMSRVRCA1-CA, DC=rad, DC=wustl, DC=edu
NotBefore: 5/14/2013 10:03 AM
NotAfter: 9/16/2014 1:35 PM
Subject: CN=rad-vmsrvedge1.rad.wustl.edu
Serial: 3fc1ee43000000000154
SubjectAltName: DNS Name=rad-vmsrvedge1.rad.wustl.edu, DNS Name=rad-vmsrvedge1, DNS Name=smtp.mir.wustl.edu
Template: WebServer
b4 93 cd 8e 03 ea 9a 81 5e 1c 28 9f 44 3d 41 32 5c 24 18 a8
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
---------------- Certificate AIA ----------------
Failed "AIA" Time: 0
Error retrieving URL: The specified network resource or device is no longer available. 0x80070037 (WIN32: 55)
ldap:///CN=rad-RAD-VMSRVRCA1-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=rad,DC=wustl,DC=ed
u?cACertificate?base?objectClass=certificationAuthority
---------------- Certificate CDP ----------------
Failed "CDP" Time: 0
Error retrieving URL: The specified network resource or device is no longer available. 0x80070037 (WIN32: 55)
ldap:///CN=rad-RAD-VMSRVRCA1-CA,CN=rad-vmsrvrca1,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=r
ad,DC=wustl,DC=edu?certificateRevocationList?base?objectClass=cRLDistributionPoint
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=rad-RAD-VMSRVRCA1-CA, DC=rad, DC=wustl, DC=edu
NotBefore: 9/16/2009 1:25 PM
NotAfter: 9/16/2014 1:35 PM
Subject: CN=rad-RAD-VMSRVRCA1-CA, DC=rad, DC=wustl, DC=edu
Serial: 21954b3e4427d9a44aaf23d2e32e0296
52 91 7e c7 06 e9 7c 67 7b a7 60 dd d6 d8 ec 28 7e 90 dc c0
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
b4 93 cd 8e 03 ea 9a 81 5e 1c 28 9f 44 3d 41 32 5c 24 18 a8
Full chain:
ca 1d db f5 4a b0 d5 f8 3f b1 25 9e ad e0 fb cb cb a4 f8 aa
------------------------------------
Verified Issuance Policies: None
Verified Application Policies:
1.3.6.1.5.5.7.3.1 Server Authentication
ERROR: Verifying leaf certificate revocation status returned The revocation function was unable to check revocation beca
use the revocation server was offline. 0x80092013 (-2146885613)
CertUtil: The revocation function was unable to check revocation because the revocation server was offline.
CertUtil: -verify command completed successfully.
Nick Cozby