I have a Server 2012 ADCS enterprise setup and have assigned a certificate to a Server 2012 remote desktop server. When I try to connect I keep getting "A Revocation check could not be performed for the certificate" It doesnt make any sense at all because when I run the following check against the certificate it get the following;
C:\Users\B14CKH4WK>certutil -verify -urlfetch C:\Users\B14CKH4WK\Desktop\aisi.ce
r
Issuer:
CN=WrinkleFreeIT-DC01-CA
DC=WrinkleFreeIT
DC=local
Name Hash(sha1): b8ad8988b31c658a5baf24840dcec04ecd41a59d
Name Hash(md5): 9794dd348116bd11b6beb0029837eeda
Subject:
CN=AISI.WrinkleFreeIT.local
Name Hash(sha1): 47d0ebf65f687137a1c29850c74352a7fb25066d
Name Hash(md5): ac1a960abf059a83a20c81740bf68f45
Cert Serial Number: 1f0000002d8816db011d1f8e5e00000000002d
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 29 Minutes, 4 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 29 Minutes, 4 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=WrinkleFreeIT-DC01-CA, DC=WrinkleFreeIT, DC=local
NotBefore: 1/29/2013 1:53 PM
NotAfter: 1/29/2014 1:53 PM
Subject: CN=AISI.WrinkleFreeIT.local
Serial: 1f0000002d8816db011d1f8e5e00000000002d
SubjectAltName: DNS Name=AISI.WrinkleFreeIT.local
Template: Machine
d8 8f 03 9a 3d 55 db d1 dd 02 eb b5 b6 e9 87 3a 03 d0 8c 08
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
Verified "Certificate (0)" Time: 0
[0.0]
http://ocsp.WrinkleFreeIT.com:8080/ocsp/ca.crt
---------------- Certificate CDP ----------------
Verified "Base CRL (10)" Time: 0
[0.0]
http://ocsp.WrinkleFreeIT.com:8080/ocsp/WrinkleFreeIT-DC01-CA.crl
Verified "Delta CRL (10)" Time: 0
[0.0.0]
http://ocsp.WrinkleFreeIT.com:8080/ocsp/WrinkleFreeIT-DC01-CA+.crl
---------------- Base CRL CDP ----------------
OK "Delta CRL (11)" Time: 0
[0.0]
http://ocsp.WrinkleFreeIT.com:8080/ocsp/WrinkleFreeIT-DC01-CA+.crl
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
CRL 10:
Issuer: CN=WrinkleFreeIT-DC01-CA, DC=WrinkleFreeIT, DC=local
ThisUpdate: 1/29/2013 1:53 PM
NextUpdate: 2/6/2013 2:13 AM
f6 d8 e9 e0 16 56 29 38 a0 79 0a d4 bb 21 b1 c9 78 e1 c7 14
Delta CRL 11:
Issuer: CN=WrinkleFreeIT-DC01-CA, DC=WrinkleFreeIT, DC=local
ThisUpdate: 1/29/2013 1:53 PM
NextUpdate: 1/31/2013 2:13 AM
ee fa 97 69 a2 20 e7 b8 05 27 e7 ee d8 2f 15 92 37 dd 12 12
Application[0] = 1.3.6.1.5.5.7.3.2 Client Authentication
Application[1] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=WrinkleFreeIT-DC01-CA, DC=WrinkleFreeIT, DC=local
NotBefore: 1/26/2013 5:18 AM
NotAfter: 1/26/2113 5:28 AM
Subject: CN=WrinkleFreeIT-DC01-CA, DC=WrinkleFreeIT, DC=local
Serial: 63ed33bf4f9be1a5462ab3cdc1980729
d2 2e 38 05 ee ae 45 28 63 b3 d2 85 41 4a d8 48 be 12 f6 7f
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
74 66 de 22 97 91 71 91 c3 82 7a 6c 99 43 ab b3 c2 b9 87 02
Full chain:
b4 2a db df bf c1 17 c6 92 65 bf 08 96 9d 30 8a aa 9e a6 72
------------------------------------
Verified Issuance Policies: None
Verified Application Policies:
1.3.6.1.5.5.7.3.2 Client Authentication
1.3.6.1.5.5.7.3.1 Server Authentication
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
Everything looks good to me and I have even published the latest CRLs and yes I have installed the CA certificate to the local computer trusted root authorities