Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to import a certificate created by a CA I've set up in Windows using AD CS. I've done the following:

1) Created my own CA (MyCompany)
2) Enabled web services (mostly for ease of configuration)
3) Generated a certificate request on the Sonicwall itself
4) Used web services to sign the certificate
5) Imported the sign certificate into the Sonicwall ...this caused the certificate to show "No" for the Verified field.
6) Imported the CA's certificate.

This is where I get stuck. I attempted to import the CRL list, but get the following error: CRL Error - Verification failed using CA certificate. No further errors appear in the logs. Without the CRL list the certificate won't verify and it doesn't appear under the "Administration" page so I can select it for use via HTTPS.

Any ideas?

Edit: From Sonicwall when I attempt to use my HTTP published list:

07/02/2013 14:33:54.256 Alert   VPN PKI Cannot Validate Issuer Path         HTTPS        
19  07/02/2013 14:33:54.256 Alert   VPN PKI CRL validation failure for Root Certificate         MyCompanyCA      
20  07/02/2013 14:33:54.256 Alert   VPN PKI Failed to Process CRL from 
Enroll/ CA: MyCompanyCA
share|improve this question
Why not make a CRL available? You should have it anyway – MDMarra Jul 2 '13 at 16:56
Agreed. You need to add an HTTP CRL Distribution Point to your certs, in addition to the LDAP one. – Ryan Ries Jul 2 '13 at 17:02
@RyanRies I added one, but it's failing to process at this point. – Nathan C Jul 2 '13 at 18:04
@NathanC Did you do it exactly like this?… :) – Ryan Ries Jul 2 '13 at 18:17
@RyanRies Yes. Changed the path - still the same problem. Updating my question with new errors. – Nathan C Jul 2 '13 at 18:35
up vote 4 down vote accepted

So, after coming back to this with a brand new CA, it appears there's actually a bug with SonicOS 5.8 that causes this issue. My CA certificate is SHA512 and SonicOS only supports SHA1. Unfortunately I can't upgrade to 5.9 yet (which resolves the issue). If this helps anyone else, awesome.

share|improve this answer

Well, doing wild guesses, lets do this:

  • lets start with the stupid thing: are you sure you are importing the correct file?! :)

  • Are the DNS correct? Can the sonicwall resolve successful the ?

  • Is time correct? make sure you have a ntp server configured in both sides, usually certificates management require correct time.

  • Does the crl url really downloads anything?

  • Can you see the windows CA logs, to confirm that the file is downloaded? or even better, load a sniffer (like wireshark) in the windows CA and see if you get any request, on what port you get the request and what you reply back. If you get nothing, check firewall, routing problems, acl , etc

If you get a request and reply successful with valid info, it's probably a sonicwall problem.

If all fails, open a service request to SonicWall, they should help you debug the problem

share|improve this answer
Weirdly enough, no request is made to the CA. I can however ping the CA and I can use certutil to validate the CRL from my own local machine. Both are on the same subnet too. It's really odd. Wireshark will probably be my only chance in this case. – Nathan C Jul 15 '13 at 22:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.