I've recently setup a new domain joined Standalone CA on a Windows 2012 R2 server which is publicly accessible and authenticating fine, however, revoked certificates still appear to be authenticating. The actual server-side revoke process works fine as in the revoked certificate gets added to the CRL after publishing but the certificate still authenticates the client end.
I've added externally accessible CDP and AIA locations and have cleared the local CRL cache the client end using the following commands:
certutil -urlcache CRL delete
certutil -setreg chain\ChainCacheResyncFiletime @now
I'm aware of the minimum OS requirements for the last command. Clients are Windows 7 upwards.
I'm using a simple test app on the client that is configured to use the one certificate so if revoked would simply stop working but isn't the case in this instance. If I remove the certificate from local certificate stores then it does stop working so confident that it's dependant on this one certificate.
All web searches so far have led to the above commands and making sure the CDP is externally resolvable but I've covered those issues already.
I appreciate and advice