Hello,
In my 2-tier PKI my offline root CA isn't showing in CDP folder. When I executed those commands in PowerShell as administrator it showed no errors:
certutil.exe -dspublish -f "C:\CertData\ADDB Labs Certificate Authority.crt" RootCA
certutil.exe -addstore -f root "C:\CertData\i-win1_ADDB Labs Certificate Authority.crt"
certutil.exe -addstore -f root "C:\CertData\ADDB Labs Certificate Authority.crl"
but when I verified and saw that my root ca is not present in CDP AD Sites and Services, I tried to execute this command in cmd as admin from C:\CertData :
- certutil -f -dspublish "ADDB Labs Certificate Authority.crl"
and got this error:
ldap:///CN=ADDB Labs Certificate Authority,CN=i-win1,CN=CDP,CN=Public Key Services,CN=Services,DC=UnavailableConfigDN?certificateRevocationList?base?objectClass=cRLDistributionPoint?certificateRevocationList ldap: 0xa: LDAP_REFERRAL: 0000202B: RefErr: DSID-03100835, data 0, 1 access points ref 1: 'unavailableconfigdn' CertUtil: -dsPublish command FAILED: 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL).
What may be the cause? Here is my config on root ca:
certutil.exe -getreg CA\CRLPublicationURLs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\ADDB Labs Certificate Authority\CRLPublicationURLs:
CRLPublicationURLs REG_MULTI_SZ =
0: 64:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl
CSURL_SERVERPUBLISHDELTA -- 40 (64)
1: 8:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
CSURL_ADDTOCRLCDP -- 8
2: 0:http://%1/CertEnroll/%3%8%9.crl
3: 6:http://pki.addb.labs.com/CertData/%3%8%9.crl
CSURL_ADDTOCERTCDP -- 2
CSURL_ADDTOFRESHESTCRL -- 4