Windows certificate authority subca offline root - Revision history

Busk at 21:35, 6 December 2023

2023-12-06T21:35:02Z

Busk at 21:33, 6 December 2023

2023-12-06T21:33:30Z

Busk at 19:07, 6 December 2023

2023-12-06T19:07:21Z

Busk at 18:47, 20 November 2023

2023-11-20T18:47:01Z

Busk at 18:46, 20 November 2023

2023-11-20T18:46:49Z

Busk at 18:06, 18 November 2023

2023-11-18T18:06:55Z

Busk at 18:03, 18 November 2023

2023-11-18T18:03:11Z

Busk at 17:24, 18 November 2023

2023-11-18T17:24:48Z

Busk at 17:20, 18 November 2023

2023-11-18T17:20:42Z

Busk: Created page with " https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca ``` The revocation function was unable to check revocation beca..."

2023-11-18T17:19:36Z

Created page with " https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca ``` The revocation function was unable to check revocation beca..."

New page

https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca
```
The revocation function was unable to check revocation because the revocation server was offline
```

Fix - Turn on rootca1 and copy *.crl files to subca(s)
```
scp rootca1.example.com:\Windows\System32\CertSrv\CertEnroll ./
scp CertEnroll\*.crl ica1.example.com:\Windows\System32\CertSrv\CertEnroll\
```

@@ Line 8: / Line 8: @@
 ```
 Active Directory Certificate Services denied request 6 because The revocation function was unable to check revocation because the revocation server was offline. 0x80092013
@@ Line 28: / Line 29: @@
-# You can try this as well
+# You can just disable the rev check as well. This is guaranteed to work
 - https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/

@@ Line 11: / Line 11: @@
 Active Directory Certificate Services denied request 6 because The revocation function was unable to check revocation because the revocation server was offline. 0x80092013
 ```
 https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca

← Older revision		Revision as of 19:07, 6 December 2023
Line 28:		Line 28:
	# You can try this as well		# You can try this as well
	- https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/		- https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/
		+
		+
		+	Ignore if offline
		+	```
		+	certutil –setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE
		+	```
		+
		+	Re-enable offline check
		+	```
		+	certutil -setreg ca\CRLFlags -CRLF_REVCHECK_IGNORE_OFFLINE
		+	```

@@ Line 25: / Line 25: @@
 Certificate Authority (Local) and right click and start Certificate Authority service and it should come up green
 You can try this as well
 - https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/

← Older revision		Revision as of 18:46, 20 November 2023
Line 24:		Line 24:

	Certificate Authority (Local) and right click and start Certificate Authority service and it should come up green		Certificate Authority (Local) and right click and start Certificate Authority service and it should come up green
		+
		+	You can try this as well
		+	- https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/

← Older revision		Revision as of 18:06, 18 November 2023
Line 1:		Line 1:
−	# ~~If adding to existing Domain~~ Add New CA Templates	+	# Add New CA Templates
		+	Certificate Templates are stored in the Active Directory so Windows CAs can share and use the certificate templates but you still need to add them to the CA
		+
		+	```
		+	Get-CATemplate
		+	```
	- You need to click on your Certificate Authority -> <name> -> Certificate Templates -> New -> Certificate Template to Issue or click Manage (manages AD Templates duplicate and modify)		- You need to click on your Certificate Authority -> <name> -> Certificate Templates -> New -> Certificate Template to Issue or click Manage (manages AD Templates duplicate and modify)

← Older revision		Revision as of 18:03, 18 November 2023
Line 1:		Line 1:
		+	# If adding to existing Domain Add New CA Templates
		+	- You need to click on your Certificate Authority -> <name> -> Certificate Templates -> New -> Certificate Template to Issue or click Manage (manages AD Templates duplicate and modify)
		+
		+
	```		```
	Active Directory Certificate Services denied request 6 because The revocation function was unable to check revocation because the revocation server was offline. 0x80092013		Active Directory Certificate Services denied request 6 because The revocation function was unable to check revocation because the revocation server was offline. 0x80092013

← Older revision		Revision as of 17:24, 18 November 2023
Line 1:		Line 1:
		+	```
		+	Active Directory Certificate Services denied request 6 because The revocation function was unable to check revocation because the revocation server was offline. 0x80092013
		+	```

	https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca		https://learn.microsoft.com/en-us/answers/questions/1320695/the-revocation-function-was-unable-to-check-revoca

← Older revision		Revision as of 17:20, 18 November 2023
Line 10:		Line 10:
	scp CertEnroll\*.crl ica1.example.com:\Windows\System32\CertSrv\CertEnroll\		scp CertEnroll\*.crl ica1.example.com:\Windows\System32\CertSrv\CertEnroll\
	```		```
		+
		+	Certificate Authority (Local) and right click and start Certificate Authority service and it should come up green