Certutil -crl problems (the directory name is invalid)

Question

Another problem for you fine experts to consider...2 tier PKI, offline Root 2008 R2, 1 Sub Ent CA in Domain1 (2008 R2) and 1 Sub Ent CA in Domain2 (2012 R2).
SubCA 1 and 2 are configured pretty much identically, however when setting up SubCA 2 I am having issues running the Certutil -CRL command to publish the CRL.
My CDP locations are configured as follows;
65:c:\WIndows\System32\CertSrv\CertEnroll\%3%8%9.crl
79:ldap://CN=%7%8,CN=CDP,CN=Public Key Services,CN=Services,%6%10
6:http://pki.domain2/CertEnrolment/%3%8%9.crl
65:file://\\pki.domain2\CertEnrolment\%3%8%9.crl
I can confirm that the base CRL publishes correctly to the CertEnroll location and LDAP correctly. But it fails trying to publish to the HTTP/File location (which is the same path).
I get the error:
CertUtil: -CRL command FAILED: 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)
CertUtil: The directory name is invalid
Also the Delta CRL fails on the CertEnroll default directory as well as the file/http path with error;
Active Directory Certificate Services could not publish a Delta CRL for key 0 to the following location: file://\\pki.domain\CertEnrolment\CANAME+.crl.
Operation aborted 0x80004004 (-2147467260 E_ABORT)<o:p></o:p>
I'm pretty certain it's not a permissions issue as I've added Everyone for NTFS/share permissions to test without any change. The install was done with an Enterprise
Admin account but I'm doing all the testing now with a normal admin account (admin in the CA/server but not domain or enterprise admin).<o:p></o:p>
<o:p></o:p>
The File/HTTP location is on the CA itself (I know this is likely not best practise, but needs to be there in the short term) so not sure if the Windows firewall comes into play.
Thanks!

Answer 1

Hi driko,
It's not a best practise to give Everyone NTFS/share permissions!
What I suggest is you
1. Create a dedicated folder f.e. "C:\Repository" on CA and share it only with permissions to specific account (see below)
2. In CA publish CRLs to c:\WIndows\System32\CertSrv\CertEnroll\%3%8%9.crl
only and create a task in task scheduler that will be running on the dedicated account and will copy c:\WIndows\System32\CertSrv\CertEnroll\*.crl
to \\pki.domain2\Repozitory\*.crl 
3. Make sure that account that is running this task on CA1 (Domain 1) has enough permissions for Repository share in Domain 2 (try running cmd as this user on
CA1 and copy files manually to \\pki.domain2\Repository\)
4. Map your http://pki.domain/CertEnrolment URL with IIS to physial C:\Repository\  folder path
Did my post help you or make you laugh? Don't forget to click the Helpful vote :) If I answered your question please mark my post as an Answer.