Here is our infrastructure:
Offline root - Server 2012 Standard
Intermediate CA that issues certificates - Server 2012 Standard
PKI server (CDP and AIA over http url) - Server 2012 Standard
Here is the URL configuration for CDP and AIA:
CDP: http://pki.domain.org/<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl
AIA: http://pki.domain.org/<ServerDNSName>_<CaName><CertificateName>.crt
CRL has 180 day validity period and is generally renewed every 5 months from the offline root CA
I am trying to set up Hyper-V replication over HTTPS so I published a certificate and everything seems fine up to the point where I hit the apply button in the Hyper-V console and it comes up with the error in the following image (thumbprint removed just cuz).
Not sure if this is relevant but I am running Hyper-V Server 2012 but also recreated this issue on Server 2012 R2 Datacenter. I have run the tests described in the following paragraph on both servers and both had the same results.
I might add that If I choose a cert from a previously set up 2008 R2 Standard CA Root/issuing server (remnants from previous admin) that is used for Client and Server Authentication, I do not receive this error although I am not familiar with how that previous setup was accomplished except that it is a standalone.
I have gone back and forth with different certutil commands (such as urlfetch, user urlfetch, and url retrieval tool) and the results are always successful and always says that leaf certificate revocation check passed. I have even run this as SYSTEM and NETWORKSERVICE accounts and always seem to have successful results. I do not want to use the workaround of bypassing the CRL check for fear that there is a greater underlying problem. I have recently created a new CRL from the offline root and copied to the CDP and AIA directory so the CRL should not be expired (nor were expiration errors reported). I will admit that I'm novice at certificate authority management so please excuse my ignorance. Please let me know if there is any more information needed or correct me if I misspoke in any part. Thank you in advance for your time!