2019 Certificate Authroity Revocation Issue

Anonymous
2020-08-28T13:38:13.95+00:00

Hi there! I'm having a rather weird issue in our Certificate Authority environment in that when I revoke a user cert, the client never becomes aware to the fact, and never shows as revoked client-side. Computer based certificates DO however get actioned and removed per GPO. The only difference is that we have no GPO setting to remove revoked certs in place for users but we do for domain joined devices. That does not seem to me that it would disable the check as that is a fundamental part of a CA.

Unfortunately I need a user cert to be revokable as mgmt wants our VPN to be modified to be cert-based. Any ideas of what might be going wrong? To my understanding, as the CRL is working for the one, it should be working for the other.

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daisy Zhou 20,791 Reputation points Microsoft Vendor
    2020-08-31T03:40:20.777+00:00

    Hello @Anonymous ,

    Thank you for posting here.

    Based on the description above, I did a test in my lab.

    1.When I configured the following GPO settings for domain users, and after I revoked user certificates, it will remove the revoked user certificates automatically.

    Automatic certificate management => Enabled
    Enroll new certificates, renew expired certificates, process pending certificate requests and remove revoked certificates => Enabled
    Update and manage certificates that use certificate templates from Active Directory =>Enabled

    21387-revo1.png

    2.But when I do not configure the GPO settings above for domain users, and after I revoked user certificate, then the revoked certificate is still in user personal store and the certificate is OK after I view the certificate status on certificate path.
    21318-revo2.png

    3.However, when I verify by running command certutil -verify certificatefile, the certificate shows it is revoked.
    21396-revo3.png

    So you can check the certificate status you mentioned and if it is actually revoked, these certificates should be not used any more.

    If you want to delete the revoked user certificates without user GPO settings, we can remove them manually.

    If I misunderstood you, please correct me.

    Best Regards,
    Daisy Zhou

    0 comments