Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a test environment where I test smart card logon using a third party CA. I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to distribute the CRL as specified in the client certificates (something like http://crl.foo.bar/the_crl.crl). However, I cannot log in because the CRL status cannot be checked. Testing the uri in the certificate in a browser gives me the CRL, so that's not the problem.

Using certutil i tried the following:

certutil -verify <my cert>

it says (relevant sections):

Revocation check skipped -- server offline
Cert is and End Entity certificate

ERROR: Verifying leaf certificate revocation status returned The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613)
CertUtil: The revocation function was unable to check revocation because the revocation server was offline.

Well, since I can navigate and download the CRL that cannot be the issue. What gives? I tried adding the downloaded CRL (letting the wizard decide where to put it), but that didn't work either, and I can't find the added CRL in any store. Where did it end up you think?

The certificate path is shortest possible with the certificate issued from the trusted root CA.


If run

certutil -verify -urlfetch <cert>

I get the error:

Error retrieving URL: This network connection does not exist. 0x800708ca (win32: 2250)

Googling for that error didn't help much. Any ideas?

Edit 2

It seems as if the certutil/CA authentication is denied access to the local webserver even though it's accessible from any browser.

I found that out when it worked when I tried to host the CRL-file on a identically configured server on another C-net (I just modified the dns record for the crl site to point the other server).

So the question now is why it is denied access?

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.