CRL errors in RDP and others

Question

I've been trying for a couple of days now to troubleshoot revocation list errors in RDP and broken chain problems in VCenter server. I'm sure it's a misconfiguration on the enterprise subordinate CA, but I cannot find out where.
I've read many other posts and solutions on this forum, but no resolve yet.
We have an offline standalone Root CA running Windows Server 2012 R2 Standard, and a Domain joined subordinate CA.
Creating the template and issuing the RDP certs works fine, but upon connection we get a
"a revocation check could not be performed for the certificate" for internal domain joined clients. Creating certificates for VCenter server also squawks about a broken chain.
Maybe cert chain is still looking for the RootCA to be online?
The AIA and CDP locations are http, and reachable from the client. If anyone can help, here is the output from the certutil -verify command from one of the many affected clients:
C:\temp>certutil -f -urlfetch -verify temp2.cer
Issuer:
    CN=VSHQECA-SUB-CA
    DC=contoso
    DC=net
Subject:
    EMPTY (DNS Name=VSHQSPICE.contoso.net)
Cert Serial Number: 2c000003c02851996be18a72270002000003c0
dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1)
dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2)
dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8)
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
  Issuer: CN=VSHQECA-SUB-CA, DC=contoso, DC=net
  NotBefore: 05/22/2014 11:26 PM
  NotAfter: 05/22/2015 11:26 PM
  Subject:
  Serial: 2c000003c02851996be18a72270002000003c0
  SubjectAltName: DNS Name=VSHQSPICE.contoso.net
  Template: contosordpCertificate
  bc 41 e9 95 b9 df fe f2 46 87 55 ec 94 84 ff d1 3f b3 00 6d
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
  ----------------  Certificate AIA  ----------------
  No CRL "Certificate (0)" Time: 4
    [0.0] http://vshqeca-sub.contoso.net/CertEnroll/VSHQECA-SUB.contoso.net_VS
HQECA-SUB-CA(2).crt
  ----------------  Certificate CDP  ----------------
  Expected Base CRL "Delta CRL (43)" Time: 4
    [0.0] http://vshqeca-sub.contoso.net/CertEnroll/VSHQECA-SUB-CA(2).crl
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  Application[0] = 1.3.6.1.4.1.311.54.1.2 Remote Desktop Authentication
CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=40
  Issuer: CN=VSRMSRootCA
  NotBefore: 03/26/2014 2:27 PM
  NotAfter: 03/23/2024 1:02 PM
  Subject: CN=VSHQECA-SUB-CA, DC=contoso, DC=net
  Serial: 5200000005b0d119bfff437395000000000005
  Template: SubCA
  08 8b cf eb c2 21 5f 4a 75 63 87 34 4b c0 29 bf 14 2b c9 fa
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  Issuance[0] = 1.2.3.4.1455.67.89.5
CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=VSRMSRootCA
  NotBefore: 03/23/2014 12:52 PM
  NotAfter: 03/23/2024 1:02 PM
  Subject: CN=VSRMSRootCA
  Serial: 15630f00af95e2a74e493d40cfa5bb62
  15 b9 31 47 68 66 ed 51 a3 ae db 78 14 41 e4 47 c3 fe 67 33
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  Issuance[0] = 1.2.3.4.1455.67.89.5
Exclude leaf cert:
  46 d2 e8 24 8f d5 4e 9b 8b d5 d5 9a 4b 1f 2d 62 1c 00 69 e7
Full chain:
  65 ce 56 db 3c 65 6f f5 a7 6a 39 23 03 bb ee fd 9f 15 c5 00
Verified Issuance Policies: None
Verified Application Policies:
    1.3.6.1.4.1.311.54.1.2 Remote Desktop Authentication
ERROR: Verifying leaf certificate revocation status returned The revocation function was unable to check revocation because the revocation server was offline. 0
x80092013 (-2146885613)
CertUtil: The revocation function was unable to check revocation because the revocation server was offline.
CertUtil: -verify command completed successfully.
Many thanks in advance...
B
B

Answer 1

Here's the output of the getreg ca command. I didn't know about that one...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\VSHQE
CA-SUB-CA:
Keys:
  CSP
  EncryptionCSP
  ExitModules
  PolicyModules
Values:
  DSConfigDN               REG_SZ = CN=Configuration,DC=contoso,DC=net
  DSDomainDN               REG_SZ = DC=contoso,DC=net
  ViewAgeMinutes           REG_DWORD = 10 (16)
  ViewIdleMinutes          REG_DWORD = 8
  CAType                   REG_DWORD = 1
    ENUM_ENTERPRISE_SUBCA -- 1
  UseDS                    REG_DWORD = 1
  ForceTeletex             REG_DWORD = 12 (18)
    ENUM_TELETEX_AUTO -- 2
    ENUM_TELETEX_UTF8 -- 10 (16)
  SignedAttributes         REG_MULTI_SZ =
    0: RequesterName
  EKUOIDsForPublishExpiredCertInCRL REG_MULTI_SZ =
    0: 1.3.6.1.5.5.7.3.3 Code Signing
    1: 1.3.6.1.4.1.311.61.1.1 Kernel Mode Code Signing
  CommonName               REG_SZ = VSHQECA-SUB-CA
  Enabled                  REG_DWORD = 1
  PolicyFlags              REG_DWORD = 0
  CertEnrollCompatible     REG_DWORD = 0
  CRLEditFlags             REG_DWORD = 100 (256)
    EDITF_ENABLEAKIKEYID -- 100 (256)
  CRLFlags                 REG_DWORD = 2
    CRLF_DELETE_EXPIRED_CRLS -- 2
  InterfaceFlags           REG_DWORD = 641 (1601)
    IF_LOCKICERTREQUEST -- 1
    IF_NOREMOTEICERTADMINBACKUP -- 40 (64)
    IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)
    IF_ENFORCEENCRYPTICERTADMIN -- 400 (1024)
  EnforceX500NameLengths   REG_DWORD = 1
  SubjectTemplate          REG_MULTI_SZ =
    0: EMail
    1: CommonName
    2: OrganizationalUnit
    3: Organization
    4: Locality
    5: State
    6: DomainComponent
    7: Country
    8: UnstructuredName
    9: UnstructuredAddress
    10: DeviceSerialNumber
  ClockSkewMinutes         REG_DWORD = a (10)
  LogLevel                 REG_DWORD = 3
  HighSerial               REG_DWORD = 2c (44)
  CAServerName             REG_SZ = VSHQECA-SUB.contoso.net
  ValidityPeriod           REG_SZ = Years
  ValidityPeriodUnits      REG_DWORD = 5
  KRACertHash              REG_MULTI_SZ =
  KRACertCount             REG_DWORD = 0
  KRAFlags                 REG_DWORD = 0
  CRLPublicationURLs       REG_MULTI_SZ =
    0: 65:C:\Windows\system32\CertSrv\CertEnroll\%3%8.crl
    CSURL_SERVERPUBLISH -- 1
    CSURL_SERVERPUBLISHDELTA -- 40 (64)
    1: 6:http://vshqeca-sub.contoso.net/CertEnroll/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    2: 10:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOCRLCDP -- 8
  CRLPeriod                REG_SZ = Weeks
  CRLPeriodUnits           REG_DWORD = 2
  CRLOverlapPeriod         REG_SZ = Hours
  CRLOverlapUnits          REG_DWORD = 0
  CRLDeltaPeriod           REG_SZ = Days
  CRLDeltaPeriodUnits      REG_DWORD = 1
  CRLDeltaOverlapPeriod    REG_SZ = Minutes
  CRLDeltaOverlapUnits     REG_DWORD = 0
  CAXchgValidityPeriod     REG_SZ = Weeks
  CAXchgValidityPeriodUnits REG_DWORD = 1
  CAXchgOverlapPeriod      REG_SZ = Days
  CAXchgOverlapPeriodUnits REG_DWORD = 1
  MaxIncomingMessageSize   REG_DWORD = 10000 (65536)
  MaxIncomingAllocSize     REG_DWORD = 10000 (65536)
  CACertPublicationURLs    REG_MULTI_SZ =
    0: 2:http://vshqeca-sub.contoso.net/CertEnroll/%1_%3%4.crt
    CSURL_ADDTOCERTCDP -- 2
    1: 0:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt
    2: 2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
    CSURL_ADDTOCERTCDP -- 2
  RequestFileName          REG_SZ = C:\VSHQECA-SUB.contoso.net_contoso-VSHQECA
-SUB-CA%4.req
  SetupStatus              REG_DWORD = 1
    SETUP_SERVER_FLAG -- 1
  Security                 REG_BINARY =
    Allow CA Administrator      BUILTIN\Administrators
    Allow Certificate Manager   BUILTIN\Administrators
    Allow CA Administrator      contoso\Domain Admins
    Allow Certificate Manager   contoso\Domain Admins
    Allow CA Administrator      contoso\Enterprise Admins
    Allow Certificate Manager   contoso\Enterprise Admins
    Allow Enroll        NT AUTHORITY\Authenticated Users
  CACertHash               REG_MULTI_SZ =
    0: 1e 0a 6c ad 0f 76 07 df 06 93 fc 06 8b cc 08 4e 19 1b 71 0f
    1: 28 22 a0 83 65 b4 28 cf d1 fc 80 ab 1d 47 51 67 60 30 f4 ff
    2: 08 8b cf eb c2 21 5f 4a 75 63 87 34 4b c0 29 bf 14 2b c9 fa
    3: 82 2b 18 53 70 52 57 8b 5c a4 01 a2 07 be 35 7a ba 4e 34 b1
  CRLDeltaNextPublish      REG_BINARY = 05/24/2014 6:59 PM
  CRLOverlapPeriodUnits    REG_DWORD = c (12)
  RequestKeyIndex          REG_DWORD = 2
  RequestKeyContainer      REG_SZ = VSHQECA-SUB-CA(2)
  CRLNextPublish           REG_BINARY = 06/06/2014 6:59 PM
  CAXchgCertHash           REG_MULTI_SZ =
    0: ef 91 d7 19 22 95 69 6f 79 e2 8d ad 80 55 b4 6c 78 ca fa 73
    1: ba 37 08 cd fc cc b9 b6 c9 08 dc 55 e5 fb 0e 3e c4 bc 60 57
    2: fd 9b 26 91 d3 5a 9f c0 f5 26 47 74 2f 7e 85 28 78 6f 1c 4c
    3: da de 90 50 73 51 ee d9 10 3b e4 94 6a a3 5f 9c 71 81 9b 1c
    4: 52 19 e2 b5 ab 73 1c 75 86 7f 1d ad ec c7 38 ff c8 81 2d f4
CertUtil: -getreg command completed successfully.
New screengrab of pkiview coming right up...
B