Revoked certificate shows as valid in the certificate viewer

Question

Hi Microsoft Team,

We have a certificate revoked by CA but when I open the certificate in windows, the certificate viewer still show: "This certificate is OK."
I have used openssl and other tools to check revocation status, result is Certificate has revoked!
Can you help me why the certificate viewer still show: "This certificate is OK."?
When the certificate viewer check revocation status?
I have found a article, in the article has a certificate has revoked and the certificate viewer is showing: "This certificate was revoked by its certification authority" https://github.com/bitcoin/bitcoin/issues/21725

Answer 1

Hi there,

This is a normal behavior.

Double click certificates and check in Certificate Path tab, this process just check the AIA path to get the CA certificates until the certification path terminates at a trusted, self-signed certificate. this process does not check the revocation information of the certificate and thus will not show if the certificate is revoked under “Certificate Status”.

More Information, please refer to the article as below:
http://technet.microsoft.com/en-us/library/cc753833.aspx

We need to use certutil -verify -urlfetch <Cert_name.cer> to check the real status. And according to the Certutil output we can find the cert has been revoked.

---------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

Hi, I did encounter the same issue, the certificate was revoked by the CA and even the certutil commands shows the status as revoked, however when I checked the site consuming this cert it showed no error. Can anyone suggest what is the actual reason for this issue? Thanks

Answer 3

@Tuan Tran

@Aromah Siddiqui

Microsoft Management Console (MMC) is not equipped with any tools to download CRLs from CDP or to ask OCSP about the final status of a certificate.

MMC mostly checks the "expiration date" of a certificate or whether the location of the certificate is in "Trusted Root CAs".

There are some scripts that Microsoft uses to check the validity of the certificates. Those scripts work while:

1. auto-enrollment is enabled on the client machines by GPO and
2. when the auto-enrollment permission is assigned to the users or the computers on the related certificate template

I would suggest you take advantage of auto-enrollment features for automatic management of certificates.

Also, this is to note that auto-enrollment works only if the CA is configured properly.

Hope this is going to be helpful.