CRL revocation check failed

Question

Issue with crl revocation check. I can telnet target server on port 80. I can download crl with internet explorer. But when i launch certutil :

C:\Users\Administrateur\Desktop>certutil -urlfetch -verify alex.cer
Émetteur:
    CN=get-SRV-DC-CA
    DC=dom
    DC=com
  Hachage du nom (sha1) : a62888b8b494cc72d5b50a3401da695e28922316
  Hachage du nom (md5) : c8c269fb24c05cd48f07ec444fa63f93
Objet:
    E=A.NOM@domaineexch.com
    CN=NOM Alexandre
  Hachage du nom (sha1) : facbf33942c29a333aeea9ade9db538d3d530ff7
  Hachage du nom (md5) : 01deefd4ec4bfb2d5bc80ed8221e486a
Numéro de série du certificat : 67f0382100000000a51b

dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwRevocationFreshnessTime: 5 Days, 47 Minutes, 28 Seconds

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwRevocationFreshnessTime: 5 Days, 47 Minutes, 28 Seconds

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 01/03/2019 15:05
  NotAfter: 29/02/2020 15:05
  Subject: E=A.NOM@domaineexch.com, CN=NOM Alexandre
  Serial: 67f0382100000000a51b
  SubjectAltName: Autre nom :Nom principal=LOGIN@mailinterne.com
  Template: 1.3.6.1.4.1.311.21.8.11025665.8001721.14437036.989286.1368235.196.5905011.1016426
  Cert: 9b28759fd75d66d04ad135b17ea93f541ace19f6
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
  ----------------  AIA de certificat  ----------------
  Échec "AIA" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?cACertificate?base?objectClass=certificationAuthority

  Vérifié "Certificat (0)" Heure : 0 b3d1bb3362ec43aedafe4c3868805db4fcda5748
    [1.0] http://SRV-DC.domain.com/CertEnroll/SRV-DC.domain.com_get-SRV-DC-CA.crt

  ----------------  CDP de certificat  ----------------
  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint

  Vérifié "Liste de révocation des certificats de base (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    [1.0.0] ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  Ancienne liste de révocation des certificats de base "Liste de révocation des certificats delta (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0.1] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  ----------------  CDP de liste de révocation des certificats de base  ----------------
  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  OK "Liste de révocation des certificats de base (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  Échec "CDP" Heure : 0 (null)
    Erreur lors de la récupération de l’URL : La ressource ou le périphérique réseau spécifié n’est plus disponible. 0x80070037 (WIN32: 55 ERROR_DEV_NOT_EXIST)
    [1.0.0] ldap:///CN=get-SRV-DC-CA,CN=SRV-DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=dom,DC=com?deltaRevocationList?base?objectClass=cRLDistributionPoint

  Ancienne liste de révocation des certificats de base "Liste de révocation des certificats delta (0592)" Heure : 0 a467254541a842b5e0819fe02e61395baeb2b4e9
    [1.0.1] http://SRV-DC.domain.com/CertEnroll/get-SRV-DC-CA.crl

  ----------------  Protocole OCSP du certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  --------------------------------
    CRL 0592:
    Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
    ThisUpdate: 28/02/2019 13:55
    NextUpdate: 08/03/2019 02:15
    CRL: a467254541a842b5e0819fe02e61395baeb2b4e9
  Application[0] = 1.3.6.1.5.5.7.3.2 Authentification du client
  Application[1] = 1.3.6.1.5.5.7.3.4 Messagerie électronique sécurisée

CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 08/04/2015 13:36
  NotAfter: 08/04/2020 13:45
  Subject: CN=get-SRV-DC-CA, DC=dom, DC=com
  Serial: 40d4e5b7f3288898496b6f9bb3f1a103
  Template: CA
  Cert: b3d1bb3362ec43aedafe4c3868805db4fcda5748
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  AIA de certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  ----------------  CDP de certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  ----------------  Protocole OCSP du certificat  ----------------
  Pas d’URL "Aucun" Heure : 0 (null)
  --------------------------------

Exclude leaf cert:
  Chain: 52a851a29e09dc1f1aec1fd5a640854e68361f94
Full chain:
  Chain: 5046b50dfefc32be7c0c470bdb7ed2843ffc288a
  Issuer: CN=get-SRV-DC-CA, DC=dom, DC=com
  NotBefore: 01/03/2019 15:05
  NotAfter: 29/02/2020 15:05
  Subject: E=A.NOM@domaineexch.com, CN=NOM Alexandre
  Serial: 67f0382100000000a51b
  SubjectAltName: Autre nom :Nom principal=LOGIN@mailinterne.com
  Template: 1.3.6.1.4.1.311.21.8.11025665.8001721.14437036.989286.1368235.196.5905011.1016426
  Cert: 9b28759fd75d66d04ad135b17ea93f541ace19f6
La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)
------------------------------------
Vérification de révocation ignorée -- le serveur est hors connexion

ERREUR : la vérification de l’état de révocation du certificat feuille a
         renvoyé La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)
CertUtil: La fonction de révocation n’a pas pu vérifier la révocation car le serveur de révocation était déconnecté.

CertUtil: -verify La commande s’est terminée correctement.

Thanks for help.

Can you download the CRL and check the Effective date and Next update dates and verify that your CRL is up to date. CRL validation will fail if you have an expired CRL. — Tim Liston, Mar 05 '19 at 15:33
Done. I've verified effective date and next update and it's ok. I also tested the revocation check from a joined domain PC and verification is ok. server which is NOK is a windows 2019 server in a DMZ not domain joined (AD 2008 R2). — Alex Lum, Mar 05 '19 at 15:40
And you verified that the DMZ server has access to the revocation list? I know you said you could telnet to it, but wasn't sure if that was from the DMZ server or a different client. Powershell: `Invoke-WebRequest 'http://URL/RevocationList.crl'` — Tim Liston, Mar 05 '19 at 15:47
Yes it have access. I downloaded CRL from it. invoke-webrequest returns status code 200. — Alex Lum, Mar 05 '19 at 15:59
On windows client domain joined, the certutil command can reach delta. tested from my NOK server from IE and powershell and no problem to reach the delta. Output from PC OK `CRL 0592: Issuer: CN=get-SRV-DC-CA, DC=domain, DC=com a4 67 25 45 41 a8 42 b5 e0 81 9f e0 2e 61 39 5b ae b2 b4 e9 Delta CRL 0598: Issuer: CN=get-SRV-DC-CA, DC=domain, DC=com...........` — Alex Lum, Mar 05 '19 at 16:35

Crypt32 · Accepted Answer · 2019-03-05T16:48:14.180

The problem is with Delta CRL http url, it points to Base CRL file. Both, Base and Delta CRLs have the same URL, thus, they point to the same file, while these are separate physical files.

Open CA management console (certsrv.msc), select CA properties, switch to Extensions tab. Make sure if HTTP url for CDP ends with <DeltaCrlAllowed>.crl. If not, edit URL (copy existing, delete and add new URL with the same settings) by inserting <DeltaCRLAllowed> variable right before file extension.
open CertEnroll folder and ensure if there are two crl files. One of them includes + character in file name.

if there are two files, make sure if the CRL (with plus sign in file name) is valid.

If http CRLs are hosted on IIS, make sure if double-escaping is enabled on IIS.

when all mentioned issues are fixed, re-publish CRL and try certutil again.

CRL revocation check failed

1 Answers1