I have a windows 2012 DA configuration using an internal MS-PKI. The CRL is published externally and included in the certificates. Windows 7 clients in my pilot can connect just fine, as long as the cached CRL information hasn't timed out. Once the Delta CRL has expired the clients can no longer connect using DA. It's obviously an issue with the external CRL but I can't figure it out.
I can manually go to the CRL URL and see the two CRL files.
However when I use Certutil on my extrernal client against the exported DA certificate I get an error. Obviously I expect the LDAP based CRL to fail but since I can manually connect and browse the HTTP CRL URL I'm not expecting it to fail. The Certutil results:
C:\WINDOWS\system32>certutil -urlfetch -verify c:\testcert\dacert.cer
Issuer:
CN=amerisure-FHAMIINDC01-CA
DC=amerisure
DC=int
Subject:
CN=DA.Amerisure.com
OU=IT
O=AMIC
L=Farmington Hills
S=Michigan
C=US
Cert Serial Number: 4ab885db000000000b4f
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwRevocationFreshnessTime: 5 Days, 18 Hours, 18 Minutes, 16 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwRevocationFreshnessTime: 5 Days, 18 Hours, 18 Minutes, 16 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
Issuer: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
NotBefore: 5/6/2013 1:25 PM
NotAfter: 5/6/2015 1:25 PM
Subject: CN=DA.Amerisure.com, OU=IT, O=AMIC, L=Farmington Hills, S=Michigan, C
=US
Serial: 4ab885db000000000b4f
Template: WebServer
99 3b 27 95 d3 38 46 9f 71 a9 01 10 9c 78 15 dd 8f 05 b7 1e
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
---------------- Certificate AIA ----------------
Failed "AIA" Time: 0
Error retrieving URL: The specified network resource or device is no longer
available. 0x80070037 (WIN32: 55)
ldap:///CN=amerisure-FHAMIINDC01-CA,CN=AIA,CN=Public%20Key%20Services,CN=Ser
vices,CN=Configuration,DC=amerisure,DC=int?cACertificate?base?objectClass=certif
icationAuthority
---------------- Certificate CDP ----------------
No IDP Intersection "Base CRL (022b)" Time: 0
[0.0] http://cm.amerisure.com/CRL/amerisure-FHAMIINDC01-CA.crl
Failed "CDP" Time: 0
Error retrieving URL: The specified network resource or device is no longer
available. 0x80070037 (WIN32: 55)
[0.0.0] ldap:///CN=amerisure-FHAMIINDC01-CA,CN=FHAMIINDC01,CN=CDP,CN=Public%
20Key%20Services,CN=Services,CN=Configuration,DC=amerisure,DC=int?deltaRevocatio
nList?base?objectClass=cRLDistributionPoint
Verified "Delta CRL (022b)" Time: 0
[0.0.1] http://cm.amerisure.com/CRL/amerisure-FHAMIINDC01-CA+.crl
Failed "CDP" Time: 0
Error retrieving URL: The specified network resource or device is no longer
available. 0x80070037 (WIN32: 55)
ldap:///CN=amerisure-FHAMIINDC01-CA,CN=FHAMIINDC01,CN=CDP,CN=Public%20Key%20
Services,CN=Services,CN=Configuration,DC=amerisure,DC=int?certificateRevocationL
ist?base?objectClass=cRLDistributionPoint
---------------- Base CRL CDP ----------------
Failed "CDP" Time: 0
Error retrieving URL: The specified network resource or device is no longer
available. 0x80070037 (WIN32: 55)
ldap:///CN=amerisure-FHAMIINDC01-CA,CN=FHAMIINDC01,CN=CDP,CN=Public%20Key%20
Services,CN=Services,CN=Configuration,DC=amerisure,DC=int?deltaRevocationList?ba
se?objectClass=cRLDistributionPoint
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
CRL 021e:
Issuer: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
0c 3a ae 50 b6 d3 72 3d 2d b8 6f 2d a4 95 8d 3d 6b 6d d2 8b
Delta CRL 0223:
Issuer: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
f3 01 af c9 2a b5 29 75 ac 7e 24 75 c7 77 67 54 1d be 44 11
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
NotBefore: 11/3/2011 10:22 AM
NotAfter: 11/3/2016 10:32 AM
Subject: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
Serial: 46161c8c02fed0bd49afe37fce6709d2
Template: CA
25 99 ff 1c 89 fb 11 7b 18 ba 9c 65 6f ae 3d ef 71 7b d8 1d
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
3f 96 38 8b 1e c7 78 34 d4 71 8e eb d1 3e ea 35 6e b3 9c 30
Full chain:
5a 32 4b 72 a1 ee 25 95 8d 62 c4 69 51 52 1d b9 d6 42 4e 19
Issuer: CN=amerisure-FHAMIINDC01-CA, DC=amerisure, DC=int
NotBefore: 5/6/2013 1:25 PM
NotAfter: 5/6/2015 1:25 PM
Subject: CN=DA.Amerisure.com, OU=IT, O=AMIC, L=Farmington Hills, S=Michigan, C
=US
Serial: 4ab885db000000000b4f
Template: WebServer
99 3b 27 95 d3 38 46 9f 71 a9 01 10 9c 78 15 dd 8f 05 b7 1e
The revocation function was unable to check revocation because the revocation se
rver was offline. 0x80092013 (-2146885613)
------------------------------------
Revocation check skipped -- server offline
ERROR: Verifying leaf certificate revocation status returned The revocation func
tion was unable to check revocation because the revocation server was offline. 0
x80092013 (-2146885613)
CertUtil: The revocation function was unable to check revocation because the rev
ocation server was offline.
CertUtil: -verify command completed successfully.