Customer has existing SSL from godaddy with multiple SAN and we're migrating to IIS 8.5 on 2012 server. Generated sha256 CSR to godaddy for this Windows server and downloaded two files for IIS. Placed the intermediate file in MMC intermediate folder, imported the .cer file into IIS top level where its SSL certificates lie. Note that I have removed all certificates from the Personal and imported into WebHosting. Looking at the godaddy certificate I can confirm "You have a private key that corresponds to this certificate". Yet, all browsers eventually report this error. This is MSIE's response:
This website’s security certificate has been revoked, so you can’t go there at this time. Error Code: ERROR_INTERNET_SEC_CERT_REVOKED
I've found this guide at the top of my search results and these are my troubleshooting results: https://support.microsoft.com/en-us/help/294305/iis-returns-http-403-13-client-certificate-revoked-error-message-altho
where I should check the CDP or the URL of each certificate in its Certification Path on the Win2012 box and see if there are problems connecting to each of those URI. These are
I can confirm that each of these using MSIE on this Win2012 box I resolve and download these files. Using Powershell I can use curl for each of these URI and return results.
This external tool verifies that the certificate is working, accepted and there is no revocation. https://www.sslshopper.com/ssl-checker.html
So, why do I still have this problem? The guide linked above suggests to use Webfetch from IIS6. It confirms that these return the results needed.
Working on the theory that GoDaddy has revoked this certificate (The certificate is valid and running on GoDaddy Apache server with other SAN), I used this to get a human-readable form of this CRL to see if it's been revoked.
certutil -dump gdig2s1-879.crl > c:\gdig-output.txt
Retrieving the 10-digit Serial number of the certificate (with key) on IIS and attempted to find that in the downloaded CRL. I fully expected to find it in this revoked list but did not. And this list was downloaded over a week after these errors started appearing so it ought to be current.
At this point, I'm uncertain as what to try next to see what I should do next to resolve this apparent disconnect.