TinyCA generated cert refused by Exchange 2013

Question

I've created a CA using TinyCA2, and have created a certificate for my Exchange 2013 server. Although the certificate installed fine on exchange, Exchange always says "Revocation Check Failed". (I've tried 10 different certificates)

My CRL is visible on the LAN and the file can be retrieved from a web browser on the exchange server. The CA certificate as setup in TinyCA2 lists "http://myserver.com/crl.pem" as the CRL.

Exchange shell shows:

Get-ExchangeCertificate | fl

AccessRules        : {System.Security.AccessControl.CryptoKeyAccessRule,
                     System.Security.AccessControl.CryptoKeyAccessRule}
CertificateDomains : {newmail.myco.com}
HasPrivateKey      : True
IsSelfSigned       : False
Issuer             : CN=MyCo, C=CA
NotAfter           : 2/26/2026 9:21:09 PM
NotBefore          : 2/29/2016 9:21:09 PM
PublicKeySize      : 2048
RootCAType         : GroupPolicy
SerialNumber       : 03
Services           : IMAP, POP
Status             : RevocationCheckFailure
Subject            : C=CA, S=Michigan, L=Detroit, O=MYCO, OU=IT3, CN=newmail.myco.com
Thumbprint         : 3EF2C92F4D3747B9

and certutil shows:

  Serial: 04
  SubjectAltName: No alternative name
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
The revocation function was unable to check revocation for the certificate. 0x80
092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK)
------------------------------------
Revocation check skipped -- no revocation information available
Cert is an End Entity certificate
Cannot check leaf certificate revocation status
CertUtil: -verify command completed successfully.

Is there something else I need to do to make exchange accept the certificate? Why is the CRL not being accepted?

We used to have a Windows CA but we have powered it off. Trying to switch to Linux. Is there something I have to tell the DC about the Windows CA no longer being active? (Is Exchange checking the old Windows CA's CRL?)

---

Update: Result of "certutil -urlfetch -verify" of the leaf certificate:

Issuer:
    CN=My Company
    C=CA
  Name Hash(sha1): b6b02cfd24a47572f68a85a398322f978989d9ef
  Name Hash(md5): 5333e962243f00751ee6fcf5b62973b9
Subject:
    C=CA
    S=State
    L=City
    O=mydomain
    OU=IT4
    CN=newmail.mydomain.com
  Name Hash(sha1): 1a7840c8a10059e8e2b87e32f32426dd6ad3d60a
  Name Hash(md5): 1b0581a411b0c14d057203950e3aca98
Cert Serial Number: 04

dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

CertContext[0][0]: dwInfoStatus=101 dwErrorStatus=40
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 9:45 PM
  NotAfter: 2/26/2026 9:45 PM
  Subject: C=CA, S=State, L=City, O=mydomain, OU=IT4, CN=newmail.mydomain.com
  Serial: 04
  SubjectAltName: No alternative name
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
  Element.dwInfoStatus = CERT_TRUST_HAS_EXACT_MATCH_ISSUER (0x1)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  --------------------------------

CertContext[0][1]: dwInfoStatus=109 dwErrorStatus=0
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 8:17 PM
  NotAfter: 2/26/2026 8:17 PM
  Subject: CN=My Company, C=CA
  Serial: 86278a3832426d41
  SubjectAltName: No alternative name
  353c6f365f9d7b2e623b7c228e937adac5ee3a2b
  Element.dwInfoStatus = CERT_TRUST_HAS_EXACT_MATCH_ISSUER (0x1)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  --------------------------------

Exclude leaf cert:
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
Full chain:
  b8408cac425b1604c28a619181394d7f057607e0
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 9:45 PM
  NotAfter: 2/26/2026 9:45 PM
  Subject: C=CA, S=State, L=City, O=mydomain, OU=IT4, CN=newmail.mydomain.com
  Serial: 04
  SubjectAltName: No alternative name
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
The revocation function was unable to check revocation for the certificate. 0x80
092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK)
------------------------------------
Revocation check skipped -- no revocation information available
Cert is an End Entity certificate
Cannot check leaf certificate revocation status
CertUtil: -verify command completed successfully.

Answer 1

I'm not sure why you would think think I somehow a windows problem. It looks like you have a valid cert with no revocation information. Verify that your CRL is online and that the CRL is in the cert.

Answer 2

For anyone else with this problem: TinyCA creates certificates without CRL's. While this is ok for most Linux hosts, Exchange (perhaps all modern Windows hosts) require a CRL. So solution is dont use TinyCA anymore. Instead, try XCA (which I confirmed works).

Answer 3

You can configure crlDistributionPoints in TinyCA2. Just open your issuing CA. Choose Preferences / OpenSSL Configuration from the menu.

Go to "Server Certificate Settings" tab and add crlDistributionPoints.