I've been working on a lab setting up a two-tier PKI using a Linux (Debian 9 with OpenSSL) root certificate authority and a Windows server 2012 R2 subordinate certificate authority.
When I attempt to install the the signed subordinate certificate on the Windows server I first get a warning stating that the root ca can not be verified. I click OK to ignore the warning after which the ADCS does not start. When I manually start the ADCS I get the Error message;
"The revocation function was unable to check revocation because the revocation server was offline"
I believe the issue is with how I am pointing to the CRL distribution point and AIA on the Linux root CA or how I am setting up IIS on the Windows server (possibly both).
Setup
- rootca: Linux Debain 9 as root certificate authority
- testpki: Windows Server 2012 R2 as subordinate certificate authority/IIS
- dc0: Windows Server 2012 R2 as domain controller
Linux
I set up a custom OpenSSL config file on rootca adding the lines;
authorityInfoAccess = caIssuer;URI:http://testpki.example.com/crld/root.cer crlDistributionPoints = URI:http://testpki.example.com/crld/root.crl
to the v3_ca and v3_intermediate_ca sections of the config file.
Windows
I set up a DNS record for "testpki.example.com" for name resolution on dc0.
The root certificate from the Linux box is imported to the Trusted Root Certificate Authority directory in the Certificate Authority snap-in on testpki.
After installing IIS on testpki, I set up a virtual directory with the alias crld and copy the root certificate and CRL to this directory.
I am able to connect to IIS when entering the URL "testpki.example.com/crld", but if I enter the URL "testpki.example.com/crld/root.cer" I get a 404 error even though "root.cer" is shown in the "../crld" page index.
the rest of the setup was done following this guide: Using openssl as a root ca for windows
Any insight would be appreciated.
-thanks
certutil -verify -urlfetch ..\subca.cer Output
Issuer: CN=example-TESTPKI-CA Name Hash(sha1): e6c59398cbed5b994ff33c6e6380312fe2ad9a4a Name Hash(md5): b0f8c7beb298a3ba230f71fbc927b386 Subject: CN=example-TESTPKI-CA-Xchg Name Hash(sha1): 86f6ae3e12a21350005b9d70b1229ecb1b78dd0b Name Hash(md5): dd1324e864c4233d2f87e9c0c342dfcd Cert Serial Number: 4b0000000478b909e350cb7280000000000004 dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40) ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000) SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40) SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000) CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0 Issuer: CN=example-TESTPKI-CA NotBefore: 2/7/2018 3:37 PM NotAfter: 2/14/2018 3:47 PM Subject: CN=example-TESTPKI-CA-Xchg Serial: 4b0000000478b909e350cb7280000000000004 Template: CAExchange a13e6c1703f95408910d21dc380818b23c76e79f Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ---------------- Certificate AIA ---------------- Wrong Issuer "Certificate (0)" Time: 0 [0.0] ldap:///CN=example-TESTPKI-CA,CN=AIA,CN=Public%20Key%20Services, Services,CN=Configuration,DC=example,DC=com?cACertificate?base?objectCla certificationAuthority Revocation Check Failed "Certificate (1)" Time: 0 [0.1] ldap:///CN=example-TESTPKI-CA,CN=AIA,CN=Public%20Key%20Services, Services,CN=Configuration,DC=example,DC=com?cACertificate?base?objectCla certificationAuthority ---------------- Certificate CDP ---------------- Verified "Base CRL (02)" Time: 0 [0.0] ldap:///CN=example,CN=com,CN=CDP,CN=Public%20Key% ervices,CN=Services,CN=Configuration,DC=example,DC=com?certificateRevoca nList?base?objectClass=cRLDistributionPoint Verified "Delta CRL (02)" Time: 0 [0.0.0] ldap:///CN=example-TESTPKI-CA,CN=testpki,CN=CDP,CN=Public%20Ke 0Services,CN=Services,CN=Configuration,DC=example,DC=com?deltaRevocation t?base?objectClass=cRLDistributionPoint ---------------- Base CRL CDP ---------------- OK "Delta CRL (02)" Time: 0 [0.0] ldap:///CN=example-TESTPKI-CA,CN=testpki,CN=CDP,CN=Public%20Key% ervices,CN=Services,CN=Configuration,DC=example,DC=com?deltaRevocationLi base?objectClass=cRLDistributionPoint ---------------- Certificate OCSP ---------------- No URLs "None" Time: 0 -------------------------------- CRL 02: Issuer: CN=example-TESTPKI-CA ThisUpdate: 2/7/2018 3:52 PM NextUpdate: 2/15/2018 4:12 AM 7f6e7f6f4d13cd98164e53d35ce406e2dde3dd3a Delta CRL 02: Issuer: CN=example-TESTPKI-CA ThisUpdate: 2/7/2018 3:52 PM NextUpdate: 2/9/2018 4:12 AM 07de3204292fbc0ab4a42cfef02b6b4837a78529 Application[0] = 1.3.6.1.4.1.311.21.5 Private Key Archival CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=1000040 Issuer: CN=rootca NotBefore: 2/7/2018 1:17 PM NotAfter: 2/6/2023 1:17 PM Subject: CN=example-TESTPKI-CA Serial: 1000 d74fdf7e86c80171e91dd72a16a1f8f72c9666a3 Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40) Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000) ---------------- Certificate AIA ---------------- Failed "AIA" Time: 0 Error retrieving URL: The request is not supported. 0x80070032 (WIN32: 50 ROR_NOT_SUPPORTED) testpki.example.com/crld/root.cer ---------------- Certificate CDP ---------------- Failed "CDP" Time: 0 Error retrieving URL: Not found (404). 0x80190194 (-2145844844 HTTP_E_STA _NOT_FOUND) http://testpki.example.com/crld/rootca.crl ---------------- Certificate OCSP ---------------- No URLs "None" Time: 0 -------------------------------- CertContext[0][2]: dwInfoStatus=10a dwErrorStatus=0 Issuer: CN=rootca NotBefore: 2/7/2018 12:54 PM NotAfter: 2/6/2023 12:54 PM Subject: CN=rootca Serial: 94cb4df27b1cb5a3 99a30cec9d5dbc21afe5e4b679e5db844f7a9dd0 Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2) Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8) Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100) ---------------- Certificate AIA ---------------- Failed "AIA" Time: 0 Error retrieving URL: The request is not supported. 0x80070032 (WIN32: 50 ROR_NOT_SUPPORTED) testpki.example.com/crld/root.cer ---------------- Certificate CDP ---------------- Failed "CDP" Time: 0 Error retrieving URL: Not found (404). 0x80190194 (-2145844844 HTTP_E_STA _NOT_FOUND) http://testpki.example/crld/rootca.crl ---------------- Certificate OCSP ---------------- No URLs "None" Time: 0 -------------------------------- Exclude leaf cert: a7b797168cbc0ff36636479d8cd2de6f2b184355 Full chain: 7e1caac607a7a5b087b491accf72df2f8d4cf06e Issuer: CN=example-TESTPKI-CA NotBefore: 2/7/2018 3:37 PM NotAfter: 2/14/2018 3:47 PM Subject: CN=example-TESTPKI-CA-Xchg Serial: 4b0000000478b909e350cb7280000000000004 Template: CAExchange a13e6c1703f95408910d21dc380818b23c76e79f The revocation function was unable to check revocation because the revocation rver was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) ------------------------------------ Revocation check skipped -- server offline Leaf certificate revocation check passed CertUtil: -verify command completed successfully.
certutil -verify -urlfetch path\subCAcert.cer
and examine errors in URL download section. If you are unsure how to interpret them, put them in your original question so we can assist you.root.cer
is testing you can access the Root CA via HTTP, which is irrelevant to revocation checking. However, the fact that you can't, even though you believe you've uploaded it, suggests your IIS isn't configured correctly. If that's the case, you most probably can't access the CRL (root.crl
) via HTTP neither, which is why you get the error message. You won't make progress until you can access testpki.example.com/crld/root.crl and retrieve the CRL (not 404 error)NotFound (HTTP404)
. This means that there is no CRL at specified path.