5

I have this weird unexplained delay before the certificates i put in my servers start actually working

it goes something like this:

I add the certificates snap-in to mmc to manage the computer account certificates

I then add some certificates to the trusted root certificates, and some to the intermediate certification authorities

The certificates i add to the trusted root certificates are of the entire organization, and the ones i add to the intermediate certification authorities are of the branch i belong to.

I publish the certificates to active directory using the cmd command "cerutil -f -dspublish RootCA" and "certutil -f -dspublish NTAuthCA"

I try to log in using my smartcard, and i get this error: "an untrusted certificate authority was detected while processing the smart card"

I wait a day, and then everything is suddenly working fine, i can log in, i don't get any errors, nothing.

I've searched everywhere for this weird delay, but i haven't managed to find anything concrete, anyone has any ideas?

Greg Askew
  • 34,339
  • 3
  • 52
  • 81
  • 1
    For information, I previously encountered such issue of a delay before certificates started to work caused by a buggy timezone issues. For instance, if you create a certificate with a validity period starting at 9AM in a UTC+2 timezone, and another application compares this date to UTC time (9AM UTC), then it will start to be valid only two hours later, at 11AM UTC+2. This behavior is buggy and should not happen, but an easy prevention measure is to generate certificates with validity period starting and ending for instance at midnight. – WhiteWinterWolf May 27 '15 at 08:29

1 Answers1

2

Two possible explanations:

1) The delay is caused by replication between domain controllers (if you have more than one)

2) The delay is caused by policies not being applied in servers when you attempt verification. Machine policies are applied every 90 minutes by default in w2k8r2, don't know what the timer is in w2k12.

(1) and (2) may be combined. I always do "gpupdate /force" in servers I would log in to when verifying certificates, have you tried it?

HBruijn
  • 72,524
  • 21
  • 127
  • 192
SlartyBartFast
  • 21
  • 2