Using an internal certificate authority I have issued a wildcard certificate that was installed on a remote desktop session host server.

I have installed the root and intermediate CA certificate on the client but I still receive a warning message when I try to connect to the session host server.

certificate warning

The certificate authority is an internal - active directory domain joined server the client is a Windows 10 computer from Internet (not domain joined)

When using the certutil -urlfetch command i get a failed verification for AIA and CDP.

Should I worry about this?
Should I ignore it since the root CA certificate is installed on the client?


Should I worry about this?

I would. This clearly indicates that your PKI design is flawed and revocation function is simply broken. Where exactly it is broken -- different question you should address.

Should I ignore it since the root CA certificate is installed on the client?

I would not. The fact that the certificate is issued by your CA means that it was correctly issued by your CA. Since issuance, CA has little control over issued certificate and can't guarantee certificate security. If necessary you won't be able to revoke the certificate before its expiration.

  • but for revocation isn't CRL point used ? (which by the way - is getting validated) – octavmarius May 9 at 14:49
  • Client attempts, but fails to reach any valid CDP point. – Crypt32 May 9 at 14:58
  • why does it need a CDP point if i have the root ca certificate installed on the client ? – octavmarius May 9 at 15:12
  • CDP must point to a CRL file which is updated by CA on a regular basis. CRL contains a list of serial numbers of revoked certificates. – Crypt32 May 9 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.