Hello,
I have a 2-tier PKI infrastructure; 1 offline stand-alone Root CA and 1 Enterprise Subordinate Issuing CA. Both are running Windows 2012 R2. The Issuing CA is a member of a WIndows 2008 R2 AD domain and is also running IIS for the CDP and AIA Publication
with the IIS virtual Directory created as
http://pki.domain.local/certenroll.
When I run the pkiview.msc tool, all the AIA and CDP locations for the Issuing CA come up as "OK" but all the AIA and CDP locations for the Root CA come up as "Unable to Download".
Here is the output from pkiview.msc for the Root CA:
AIA Location #1 Unable to Download
http://pki.domain.local/certenroll/%1_%3%4.crt
AIA Location #2 Unable to Download ldap:///CN=%7,CN=AIA,CN=Public%20Key%20Services,CN=Services,%6%11
CDP Location #1 Unable to Download
http://pki.domain.local/certenroll/%3%8%9.crl
CDP Location #2 Unable to Download ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public%20Key%20Services,CN=Services,%6%10
For the Issuing CA all the %# codes translate correctly to the file name but it looks like this failed for the root CA.
On the Root CA, I have the following AIA and CDP setting defined in the CA Tool Extensions properties:
Authority Information Access (AIA):
WINDIR\system32\CertSrv\CertEnroll\<ServerDNSName>_<CaName><CertificateName>.crt
,CN=AIA,CN=Public">ldap:///CN=<CATruncatedName>,CN=AIA,CN=Public
Key Services,CN=Services,<ConfigurationContainer><CAObjectClass>
CRL Distribution Point (CDP):
WINDIR\system32\CertSrv\CertEnroll\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crt
<CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public">ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=<ServerShortName>,CN=CDP,CN=Public
Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>
C:\Windows\System32\CertEnroll\Root Certification Authority.crl
<a href="http://pki.domain.local/certenroll/.crl">http://pki.domain.local/certenroll/<CaName>.crl
In the registry, this is the CACertPublicationURLs value:
1:WINDIR\system32\CertSrv\CertEnroll\%1_%3%4.crt
2:http://pki.domain.local/certenroll/%1_%3%4.crt
2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
and the CRLPublicationURLs value:
1:WINDIR\system32\CertSrv\CertEnroll\%3%8%9.crl
2:http://pki.domain.local/certenroll/%3%8%9.crl
10:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
0:C:\Windows\System32\CertSrv\CertEnroll\Root Certification Authority.crl
0:http://pki.domain.local/certenroll/%3.crl
On my IIS virtual directory location of the Issusing/IIS Server, the CertEnroll folder has the following files for the Root CA:
"Root Cerification Authority.crl"
"PKI01_Root Certification Authority.crt" where "PKI01" is the name of the Root CA Server
Question 1 : Is this a big problem that these entries are wrong for the Root CA? Should I correct them?
Question 2 : if so, How do I correct them? Can you give me the correct certutil or any other commands to correct them with the right file names? Do I do these commands on the offline Root CA?
Question 3: Do I need to recreate the root certificate and Issuing Server certificate? If so, how and do I need to deploy all new certificate to clients that obtained certificates from the Issuing CA?
Question 4: Are there any more steps required to resolve this issue?
Thank you.
Steve