AIA return Wrong Issuer

Question

i check with certutil -verify -urlfetch .\client.cer

check for AIA, there are 3 ldap checking, the link are totally the same, but "Wrong Issuer" twice, 1 verified, but there also be only 1 ldap link in cert's AIA properties

thx

Answer 1

AIA entry may store multiple certificates, this is why you may see multiple entries during validation: certutil enumerates all certificates in the entry and tries to find matching. So it is totally possible to see multiple AIA entries in certutil even if only single URL is specified in cert's AIA extension.

There are two scenarios that may cause this observation:

1. You have renewed your CA with new key pair twice. In this case, you should not take any actions. It is perfectly legit and expected behavior.
2. someone played with CA in the past and used same name for CA and didn't clean up AD after tests. To test this, open PKIView.msc MMC snap-in, right-click on root node and select Manage AD Containers and switch to AIA tab. Evaluate every certificate and find any that should not be there by comparing them with certificates stored on your CA (in CA properties). If there are certificates left from testing -- you can remove them.

Answer 2

Hi 51892182,

First try configuring the CDP and AIA Extensions on CA1

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1

To isolate the problem to the Certificate Revocation Check, create the following registry key on the VDA.

Note: This key should be deleted once the actual issue is resolved

HKEY_Local_Machine\System\CurrentControlSet\Control\LSA\Kerberos\Parameters
Value Name: UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors
Value Type: DWORD
Value Data: 1
Description: After you set this DWORD value to 1.

The Kerberos clients (Smartcard logon clients) will ignore "revocation unknown" errors that are caused by an expired CRL.

----------

--If the reply is helpful, please Upvote and Accept it as an answer--