I have a test environment where I test smart card logon using a third party CA. I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to distribute the CRL as specified in the client certificates (something like http://crl.foo.bar/the_crl.crl). However, I cannot log in because the CRL status cannot be checked. Testing the uri in the certificate in a browser gives me the CRL, so that's not the problem.
Using certutil i tried the following:
certutil -verify <my cert>
it says (relevant sections):
Revocation check skipped -- server offline Cert is and End Entity certificate ERROR: Verifying leaf certificate revocation status returned The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613) CertUtil: The revocation function was unable to check revocation because the revocation server was offline.
Well, since I can navigate and download the CRL that cannot be the issue. What gives? I tried adding the downloaded CRL (letting the wizard decide where to put it), but that didn't work either, and I can't find the added CRL in any store. Where did it end up you think?
The certificate path is shortest possible with the certificate issued from the trusted root CA.
certutil -verify -urlfetch <cert>
I get the error:
Error retrieving URL: This network connection does not exist. 0x800708ca (win32: 2250)
Googling for that error didn't help much. Any ideas?
It seems as if the certutil/CA authentication is denied access to the local webserver even though it's accessible from any browser.
I found that out when it worked when I tried to host the CRL-file on a identically configured server on another C-net (I just modified the dns record for the crl site to point the other server).
So the question now is why it is denied access?