Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various Java/.NET/browser clients) without issue.

One user (running WinXP SP3 / IE8) receives the following error when trying to import the CA cert into their trusted root store: "This certificate was revoked by its certification authority"

The CA does reference a CRL which I created myself, but it is empty. The user can manually access and view the CRL and confirm it is empty. CRL checking is disabled in IE, but I guess this setting may not apply when populating the cert store.

What could explain this? Is there any way that a revoked cert from a different CA but with the same fingerprint could cause my CA cert to be flagged as revoked?

share|improve this question
    
The fingerprint is unique to the cert, so that wouldn't be the case, unless you were extremely unlucky. –  dunxd Dec 7 '11 at 17:05
add comment

1 Answer 1

This is what happens when their client can't access your CRL.

See http://support.microsoft.com/kb/289749:

Q8: What error message appears in the Web browser if an effective CRL cannot be obtained? Is the same error message displayed if the CRL is obtained and if the certificate is revoked?

A8: Yes, you receive the same error message in both scenarios. You receive the following error message:

HTTP 403.13 Forbidden: Client
certificate revoked 

The page requires a valid client certificate
share|improve this answer
    
As I said: "The user can manually access and view the CRL", i.e. IE can access the CRL URL. Other WinXP machines on the same LAN can install the cert without this issue occurring. The "client" in this case is the part of Windows that checks certs before installing them in the local cert store. –  Kieran Tully Dec 7 '11 at 13:25
1  
Microsoft have a lengthy white paper on troubleshooting certificates - see technet.microsoft.com/en-us/library/cc700843.aspx –  dunxd Dec 7 '11 at 17:02
1  
If you are only seeing this on a single machine, can you identify anything different about that machine? E.g. group policy applied. Have you tried creating a new cert and seeing whether the same problem exists on this computer or others? –  dunxd Dec 7 '11 at 17:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.