Mumble Client is signed and timestamped by StartSSL. It works fine when I try it on my home machine, but when I try to run it at the office machine, it keeps whining that it cannot verify the time stamp signature because it cannot find a revocation list. I checked that it can verify the chain certificates just fine with certutil -url file, but the last step, the Timestamp Authority, won't verify because it has no CRL. Why is this? Any ideas?
This is what certutil -v -verify has to say:
Issuer:
CN=StartCom Class 2 Primary Intermediate Object CA
OU=Secure Digital Certificate Signing
O=StartCom Ltd.
C=IL
[0,0]: CERT_RDN_PRINTABLE_STRING, Length = 2 (2/2 Characters)
2.5.4.6 Country/Region (C)="IL"
49 4c IL
49 00 4c 00 I.L.
[1,0]: CERT_RDN_PRINTABLE_STRING, Length = 13 (13/64 Characters)
2.5.4.10 Organization (O)="StartCom Ltd."
53 74 61 72 74 43 6f 6d 20 4c 74 64 2e StartCom Ltd.
53 00 74 00 61 00 72 00 74 00 43 00 6f 00 6d 00 S.t.a.r.t.C.o.m.
20 00 4c 00 74 00 64 00 2e 00 .L.t.d...
[2,0]: CERT_RDN_PRINTABLE_STRING, Length = 34 (34/64 Characters)
2.5.4.11 Organizational Unit (OU)="Secure Digital Certificate Signing"
53 65 63 75 72 65 20 44 69 67 69 74 61 6c 20 43 Secure Digital C
65 72 74 69 66 69 63 61 74 65 20 53 69 67 6e 69 ertificate Signi
6e 67 ng
53 00 65 00 63 00 75 00 72 00 65 00 20 00 44 00 S.e.c.u.r.e. .D.
69 00 67 00 69 00 74 00 61 00 6c 00 20 00 43 00 i.g.i.t.a.l. .C.
65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 e.r.t.i.f.i.c.a.
74 00 65 00 20 00 53 00 69 00 67 00 6e 00 69 00 t.e. .S.i.g.n.i.
6e 00 67 00 n.g.
[3,0]: CERT_RDN_PRINTABLE_STRING, Length = 47 (47/64 Characters)
2.5.4.3 Common Name (CN)="StartCom Class 2 Primary Intermediate Object CA"
53 74 61 72 74 43 6f 6d 20 43 6c 61 73 73 20 32 StartCom Class 2
20 50 72 69 6d 61 72 79 20 49 6e 74 65 72 6d 65 Primary Interme
64 69 61 74 65 20 4f 62 6a 65 63 74 20 43 41 diate Object CA
53 00 74 00 61 00 72 00 74 00 43 00 6f 00 6d 00 S.t.a.r.t.C.o.m.
20 00 43 00 6c 00 61 00 73 00 73 00 20 00 32 00 .C.l.a.s.s. .2.
20 00 50 00 72 00 69 00 6d 00 61 00 72 00 79 00 .P.r.i.m.a.r.y.
20 00 49 00 6e 00 74 00 65 00 72 00 6d 00 65 00 .I.n.t.e.r.m.e.
64 00 69 00 61 00 74 00 65 00 20 00 4f 00 62 00 d.i.a.t.e. .O.b.
6a 00 65 00 63 00 74 00 20 00 43 00 41 00 j.e.c.t. .C.A.
Subject:
CN=StartCom Time-Stamping Authority
O=StartCom Ltd.
C=IL
[0,0]: CERT_RDN_PRINTABLE_STRING, Length = 2 (2/2 Characters)
2.5.4.6 Country/Region (C)="IL"
49 4c IL
49 00 4c 00 I.L.
[1,0]: CERT_RDN_PRINTABLE_STRING, Length = 13 (13/64 Characters)
2.5.4.10 Organization (O)="StartCom Ltd."
53 74 61 72 74 43 6f 6d 20 4c 74 64 2e StartCom Ltd.
53 00 74 00 61 00 72 00 74 00 43 00 6f 00 6d 00 S.t.a.r.t.C.o.m.
20 00 4c 00 74 00 64 00 2e 00 .L.t.d...
[2,0]: CERT_RDN_PRINTABLE_STRING, Length = 32 (32/64 Characters)
2.5.4.3 Common Name (CN)="StartCom Time-Stamping Authority"
53 74 61 72 74 43 6f 6d 20 54 69 6d 65 2d 53 74 StartCom Time-St
61 6d 70 69 6e 67 20 41 75 74 68 6f 72 69 74 79 amping Authority
53 00 74 00 61 00 72 00 74 00 43 00 6f 00 6d 00 S.t.a.r.t.C.o.m.
20 00 54 00 69 00 6d 00 65 00 2d 00 53 00 74 00 .T.i.m.e.-.S.t.
61 00 6d 00 70 00 69 00 6e 00 67 00 20 00 41 00 a.m.p.i.n.g. .A.
75 00 74 00 68 00 6f 00 72 00 69 00 74 00 79 00 u.t.h.o.r.i.t.y.
Cert Serial Number: 18
18
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwRevocationFreshnessTime: 130 Days, 2 Hours, 1 Minutes, 59 Seconds
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwRevocationFreshnessTime: 130 Days, 2 Hours, 1 Minutes, 59 Seconds
CertContext[0][0]: dwInfoStatus=2 dwErrorStatus=40
Issuer: CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
NotBefore: 26.10.2007 1:02
NotAfter: 25.10.2012 1:00
Subject: CN=StartCom Time-Stamping Authority, O=StartCom Ltd., C=IL
Serial: 18
99 eb cb 17 25 ec 99 c4 27 fa c4 94 61 09 82 6b 46 6d 13 45
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
Application[0] = 1.3.6.1.5.5.7.3.8 Time Stamping
CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
NotBefore: 25.10.2007 1:01
NotAfter: 25.10.2017 1:01
Subject: CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
Serial: 24
d8 93 c4 f6 78 f8 91 f2 82 3c d0 78 aa 5e 1c 48 fd 1d a2 25
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
CRL (null):
Issuer: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
54 b0 90 c2 4e 91 9c a0 a0 7f d7 ac 2f cb 15 ee 09 84 8a 3a
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
Application[1] = 1.3.6.1.5.5.7.3.2 Client Authentication
Application[2] = 1.3.6.1.5.5.7.3.4 Secure Email
Application[3] = 1.3.6.1.5.5.7.3.3 Code Signing
Application[4] = 1.3.6.1.5.5.7.3.8 Time Stamping
Application[5] = 1.3.6.1.4.1.311.10.3.4 Encrypting File System
Application[6] = 1.3.6.1.5.5.7.3.6 IP security tunnel termination
Application[7] = 1.3.6.1.5.5.7.3.7 IP security user
CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
NotBefore: 17.9.2006 22:46
NotAfter: 17.9.2036 22:46
Subject: CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
Serial: 01
3e 2b f7 f2 03 1b 96 f3 8c e6 c4 d8 a8 5d 3e 2d 58 47 6a 0f
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Issuance[0] = 1.3.6.1.4.1.23223.1.1.1
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
Application[1] = 1.3.6.1.5.5.7.3.2 Client Authentication
Application[2] = 1.3.6.1.5.5.7.3.4 Secure Email
Application[3] = 1.3.6.1.5.5.7.3.3 Code Signing
Application[4] = 1.3.6.1.5.5.7.3.8 Time Stamping
Application[5] = 1.3.6.1.4.1.311.10.3.4 Encrypting File System
Application[6] = 1.3.6.1.5.5.7.3.6 IP security tunnel termination
Application[7] = 1.3.6.1.5.5.7.3.7 IP security user
Exclude leaf cert:
8b ba 34 a2 cf 0c 44 af b2 04 87 eb 78 d0 0b c4 d4 f2 82 94
Full chain:
d8 a2 5a 51 1a 86 64 6e 93 f5 69 a2 a1 0b 65 42 38 89 9d b5
Issuer: CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL
NotBefore: 26.10.2007 1:02
NotAfter: 25.10.2012 1:00
Subject: CN=StartCom Time-Stamping Authority, O=StartCom Ltd., C=IL
Serial: 18
99 eb cb 17 25 ec 99 c4 27 fa c4 94 61 09 82 6b 46 6d 13 45
The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614)
------------------------------------
Revocation check skipped -- no revocation information available
Cert is an End Entity certificate
Cannot check leaf certificate revocation status
CertUtil: -verify command completed successfully.
