Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various Java/.NET/browser clients) without issue.

One user (running WinXP SP3 / IE8) receives the following error when trying to import the CA cert into their trusted root store: "This certificate was revoked by its certification authority"

The CA does reference a CRL which I created myself, but it is empty. The user can manually access and view the CRL and confirm it is empty. CRL checking is disabled in IE, but I guess this setting may not apply when populating the cert store.

What could explain this? Is there any way that a revoked cert from a different CA but with the same fingerprint could cause my CA cert to be flagged as revoked?

share|improve this question
The fingerprint is unique to the cert, so that wouldn't be the case, unless you were extremely unlucky. – dunxd Dec 7 '11 at 17:05

This is what happens when their client can't access your CRL.


Q8: What error message appears in the Web browser if an effective CRL cannot be obtained? Is the same error message displayed if the CRL is obtained and if the certificate is revoked?

A8: Yes, you receive the same error message in both scenarios. You receive the following error message:

HTTP 403.13 Forbidden: Client
certificate revoked 

The page requires a valid client certificate
share|improve this answer
As I said: "The user can manually access and view the CRL", i.e. IE can access the CRL URL. Other WinXP machines on the same LAN can install the cert without this issue occurring. The "client" in this case is the part of Windows that checks certs before installing them in the local cert store. – Kieran Tully Dec 7 '11 at 13:25
Microsoft have a lengthy white paper on troubleshooting certificates - see – dunxd Dec 7 '11 at 17:02
If you are only seeing this on a single machine, can you identify anything different about that machine? E.g. group policy applied. Have you tried creating a new cert and seeing whether the same problem exists on this computer or others? – dunxd Dec 7 '11 at 17:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.