Re: Error issuing certificates from WS03 cert svc

Hi Brian,
Before doing anything, PKIView shows that the AIA and CDP values are valid through the entire hierarchy. Moreover, I installed an additional issuing CA with the same configuration as the original. The new CA has no problem and is able to issue end entity certs.Next, I restored the revoked CA certs. However, no change. I still get the same error on the original issuing CA but the new can issue certs. So, I'm still not really sure what's going on and where the problem is. BTW, I'm not quite sure I understand why the removal of the revoked CA certs should be problem since the original issuing CA has a valid trust with the new CA certs - can you elaborateon that?

Regarding PKIView, can you tell where it is retrieving its information about AIAs and CPDs?

Thanks,
Thomas
"Brian Komar" <bkomarr@xxxxxxxxxxxxxxxxx> wrote in message news:roweefjxepj2.dnijvb3epvj4.dlg@xxxxxxxxxxxxx
Your problem was the removal of the revoked certificates. By removing the
certificates, you will get the message that regarding unable to determine
the revocation information

When you use certutil -verify -urlfetch, do it against a leaf or end entity
certificate.
Also, what does PKiView.msc show?
brian

On Tue, 17 Apr 2007 22:53:07 +0200, Thomas Godsk Jørgensen wrote:

Hi,

I'm having trouble with issuing certificates from a Windows Server 2003
enterprise (subordinate) issuing CA. The CA rejects requests with a warning
in the Windows Application Log (Event ID: 53, Source: CerSvc): "Certificate
Services denied request 932 because: The revocation function was unable to
check revocation because the revocation server was offline. 0x80092013
(-2146885613). The request was for <here comes specific cert subject info>.
Additional information: Error Constructing or Publishing Certificate"

The setup is a three-level hierarchy with offline policy and root CAs set-up
according to Microsoft's best practice PKI white paper and Brian Komar's
MSPress PKI book. All CAs' CRLs are published on a web server (http) and in
AD (ldap). The policy CA has a revoked CA cert superseeded by a renewed
valid CA cert. The issuing CA has one revoked CA cert superseeded by two
renewed valid CA certs. All certs are likewise published on the web server
and in AD, but revoked certs have been removed from the web server. Validity
of cert and trust chain of issuing CA's valid certs has been successfully
verified with certutil -verify -urlfetch <CA_certs>.

Trouble began after root and policy CA CRLs expired and were renewed too
late. Now, all CRLs are current/valid as verified using certutil. Still, the
issuing CA denies requests with the above error message - except in a very
few apparent random cases.

Anybody experienced this or has any ideas?

Thanks very much.


Best regards,
Thomas Godsk Joergensen
thomas@xxxxxxxxx

.

Relevant Pages

  • Re: Moving the AIA and CDP for an Issuing CA
    ... my changes did apparently make the DeltaCRL location change ... > to the web server, because now it points to the web server (not the ... > issuing CA) for http and finds the DeltaCRL fine. ... the Issuing CA certificate will still ...
    (microsoft.public.windows.server.security)
  • Re: ADFS and Certificate Services
    ... ADFS is not really related to becoming a certificate vendor. ... but it won't help you with requesting or issuing certs. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Error issuing certificates from WS03 cert svc
    ... is able to issue end entity certs.Next, I restored the revoked CA certs. ... I still get the same error on the original issuing CA ... certificate. ... I'm having trouble with issuing certificates from a Windows Server 2003 ...
    (microsoft.public.windows.server.security)
  • Re: 2003 PKI Design Question
    ... >> Your two basic options are to create your own root and deal with the ... > For certificates that need to be trusted externally, chain an issuing CA ... This would issue S/MIME certs, ... > signing certs if the code signing certs need to be externally trusted. ...
    (microsoft.public.windows.server.security)
  • Certificate Services - Root CA
    ... We run 2 enterprise subordinate CA's in our AD for issuing ... Domain Controller certs. ... Basically I have a root ca set up on a DC. ...
    (microsoft.public.win2000.security)