Fixing expired Root CA CDP and Crypt_E_REVOCATION_OFFLINE problems

Step-by-Step Tutorial: Fixing Expired Root CA CDP and Crypt_E_REVOCATION_OFFLINE Problems

1. Assessing the Issue:

   • Watch the video to understand the specific problems with the PKI lab environment, including expired certificates and issues with CRLs and Delta CRLs.

2. Identifying the Root Cause:

   • Launch pki view.msc on the issuing CA server to identify the specific problems that need to be addressed.

3. Restarting the Issuing CA Server:

   • If there are issues with CRLs and Delta CRLs, restart the issuing CA server (SE1) to resolve these problems.

4. Referring to a Blog Post for Detailed Solutions:

   • Check out the blog post by Stealth Puppy for a detailed explanation of the problem and potential workarounds.

5. Temporary Fix with Command:

   • Execute the necessary command as suggested in the blog post to temporarily fix the issues and start the necessary services.

6. Refreshing the PKI Environment:

   • Verify that the PKI environment is functioning properly by checking the OCSP from the web server.

7. Updating CDP Locations:

   • Identify and update the expired CDP locations, particularly the CRL from the Root CA.

8. Managing the Root CA:

   • Ensure the Root CA is online to issue a new CRL and update the existing one.

9. Copying New CRL:

   • Use the certutil tool with the DS publish switch to copy the new CRL to the necessary locations.

10. Verifying Changes:

    • Confirm that the new CRL has been successfully published and updated in the PKI environment.

11. Restarting Web Server:

    • Restart the web server, especially the OCSP service, to ensure all components are functioning correctly.

12. Final Checks and Upgrades:

    • Verify that all issues related to CRLs and OCSP have been resolved before proceeding with any upgrades on the configuration manager server.

13. Completion and Maintenance:

    • Ensure that the PKI environment is now ready for use and perform regular checks to maintain its integrity and functionality.

By following these steps, you can effectively address and resolve the expired Root CA CDP and Crypt_E_REVOCATION_OFFLINE problems in your PKI lab environment.