Enterprise PKI - Unable to download, error AIA and OCSP

Question

I just added a subordinate CA to my environment and am trying to get these two errors worked out.  The AIA location that points to my subCA's cert errors in pkiview.msc stating it is unable to download.  I have checked the folder and it contains
the certificate and CRL.  I also found that I am unable to download the cert by typing in the web address:
http://subCA.domain.com/CertEnroll/subCA.domain.com_subCA.crt
I'm not sure what I'm missing in my config that will get this to work.  Both servers are running 2008 R2 Enterprise.
I am also getting an error message regarding my OCSP server.  I am pointing OCSP to my Root CA, but there is an error regarding that location on my subCA; no error on Root.
Thank in advance.

Answer 1

Here is the output from the verify command.  It looks like it is complaining about my OCSP certificate.  I did modify the output a little to hide my actual domain information, so it may look a little weird.
Issuer:
    CN=controller2
    DC=domain
    DC=domain
    DC=com
    [0,0]: CERT_RDN_IA5_STRING, Length = 3 (3/128 Characters)
        0.9.2342.19200300.100.1.25 Domain Component (DC)="com"
        63 6f 6d                                           com
        63 00 6f 00 6d 00                                  c.o.m.
    [1,0]: CERT_RDN_IA5_STRING, Length = 7 (7/128 Characters)
        0.9.2342.19200300.100.1.25 Domain Component (DC)="domain"
    [2,0]: CERT_RDN_IA5_STRING, Length = 3 (3/128 Characters)
        0.9.2342.19200300.100.1.25 Domain Component (DC)="domain"
    [3,0]: CERT_RDN_PRINTABLE_STRING, Length = 11 (11/64 Characters)
        2.5.4.3 Common Name (CN)="controller2"
        63 6f 6e 74 72 6f 6c 6c  65 72 32                  controller2
        63 00 6f 00 6e 00 74 00  72 00 6f 00 6c 00 6c 00   c.o.n.t.r.o.l.l.
        65 00 72 00 32 00                                  e.r.2.
Subject:
    CN=test.domain.domain.com
    [0,0]: CERT_RDN_PRINTABLE_STRING, Length = 20 (20/64 Characters)
        2.5.4.3 Common Name (CN)="test.domain.domain.com"
Cert Serial Number: 141693c100000000003c
    3c 00 00 00 00 00 c1 93  16 14
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_IS_REVOKED (0x4)
ChainContext.dwRevocationFreshnessTime: 5 Days, 2 Hours, 30 Minutes, 4 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_REVOKED (0x4)
SimpleChain.dwRevocationFreshnessTime: 5 Days, 2 Hours, 30 Minutes, 4 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=4
  Issuer: CN=controller2, DC=domain, DC=domain, DC=com
  NotBefore: 6/23/2014 8:32 AM
  NotAfter: 6/16/2016 8:23 AM
  Subject: CN=test.domain.domain.com
  Serial: 141693c100000000003c
  SubjectAltName: DNS Name=test.domain.domain.com
  Template: WebServer
  4c 5a b9 ab 87 80 3e df ed 9a 7f da be 59 d6 98 05 af ab e4
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_IS_REVOKED (0x4)
  ----------------  Certificate AIA  ----------------
  Verified "Certificate (0)" Time: 0
    [0.0] ldap:///CN=controller2,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=domain,DC=domain,DC=com?cACertificate?base?objectClass=certificationAuthority
  Verified "Certificate (0)" Time: 0
    [1.0] http://controller2.domain.domain.com/certenroll/controller2.domain.domain.com_controller2.crt
  ----------------  Certificate CDP  ----------------
  Verified "Base CRL (0b)" Time: 0
    [0.0] http://controller2.domain.domain.com/CertEnroll/controller2.crl
  ----------------  Base CRL CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
http://controller2.domain.domain.com/ocsp/MEswSTBHMEUwQzAJBgUrDgMCGgUABBTGYfObkkJSqlANW1AVyWfI%2bjrNwwQUWjvx6odKhuGe8jdbNqX%2bJAnRVFYCChQWk8EAAAAAADw%3d?Content-Type: application/ocsp-request
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
Application[0] = 1.3.6.1.5.5.7.3.9 OCSP Signing
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=40
  Issuer: CN=Controller1, DC=domain, DC=domain, DC=com
  NotBefore: 6/20/2014 4:33 PM
  NotAfter: 7/4/2014 4:33 PM
  Subject: CN=CONTROLLER2.domain.domain.com
  Serial: 1019856900000000006a
  SubjectAltName: DNS Name=CONTROLLER2.domain.domain.com
  Template: OCSP Response Signing
  f4 6e 96 24 8d be 3d bc aa 0a 19 4b 7e 42 36 00 45 58 b3 b7
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  Application[0] = 1.3.6.1.5.5.7.3.9 OCSP Signing
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=Controller1, DC=domain, DC=domain, DC=com
  NotBefore: 2/11/2014 4:26 PM
  NotAfter: 2/11/2024 4:36 PM
  Subject: CN=Controller1, DC=domain, DC=domain, DC=com
  Serial: 36abd79a207463a4405ab6c1c19788a2
  8e 12 c3 6a 9c 8b 35 db 70 27 64 14 ee d7 bf a4 a1 32 88 bf
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
Exclude leaf cert:
  f4 6e 96 24 8d be 3d bc aa 0a 19 4b 7e 42 36 00 45 58 b3 b7
Full chain:
  e6 d2 e8 eb a8 69 77 27 cc b8 37 24 de d5 00 4b 9a 88 5b ba
  Issuer: CN=Controller1, DC=domain, DC=domain, DC=com
  NotBefore: 6/20/2014 4:33 PM
  NotAfter: 7/4/2014 4:33 PM
  Subject: CN=CONTROLLER2.domain.domain.com
  Serial: 1019856900000000006a
  SubjectAltName: DNS Name=CONTROLLER2.domain.domain.com
  Template: OCSP Response Signing
  f4 6e 96 24 8d be 3d bc aa 0a 19 4b 7e 42 36 00 45 58 b3 b7
The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614)
  Verified "OCSP" Time: 0
    [0.0] http://controller2.domain.domain.com/ocsp
    CRL 0b:
    Issuer: CN=controller2, DC=domain, DC=domain, DC=com
    c6 42 3a 4c 2e a0 49 5b 0d 99 b4 9f 27 13 12 ea c4 e9 c0 6d
  Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=0
  Issuer: CN=Controller1, DC=domain, DC=domain, DC=com
  NotBefore: 6/16/2014 8:13 AM
  NotAfter: 6/16/2016 8:23 AM
  Subject: CN=controller2, DC=domain, DC=domain, DC=com
  Serial: 15b2082c000000000043
  Template: SubCA
  f0 04 e9 b9 1f 65 fe 01 3f bb 77 f7 9d 64 4e 38 9b 1f 06 32
  Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  Verified "Certificate (0)" Time: 0
    [0.0] ldap:///CN=Controller1,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=domain,DC=domain,DC=com?cACertificate?base?objectClass=certificationAuthority
  Verified "Certificate (0)" Time: 0
    [1.0] http://controller1.domain.domain.com/CertEnroll/Controller1.domain.domain.com_Controller1.crt
  ----------------  Certificate CDP  ----------------
  Verified "Base CRL (55)" Time: 0
    [0.0] ldap:///CN=Controller1,CN=Controller1,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=domain,DC=domain,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint
  ----------------  Base CRL CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
http://controller1.domain.domain.com/ocsp/MEswSTBHMEUwQzAJBgUrDgMCGgUABBSWFpoon%2bP%2b4F2xce34%2bLAmIUiu2QQUihnqzDjKy9KFeEFWkyQQc6W%2fpuUCChWyCCwAAAAAAEM%3d?Content-Type: application/ocsp-request
  Verified "OCSP" Time: 0
    [0.0] http://controller1.domain.domain.com/ocsp
    CRL (null):
    Issuer: CN=Controller1.domain.domain.com
    9c f8 ad 7d 8f 87 a5 ff 0c 97 3d d2 97 ea 1b bb 8a e9 10 ff
CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
  Issuer: CN=Controller1, DC=domain, DC=domain, DC=com
  NotBefore: 2/11/2014 4:26 PM
  NotAfter: 2/11/2024 4:36 PM
  Subject: CN=Controller1, DC=domain, DC=domain, DC=com
  Serial: 36abd79a207463a4405ab6c1c19788a2
  8e 12 c3 6a 9c 8b 35 db 70 27 64 14 ee d7 bf a4 a1 32 88 bf
  Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
Exclude leaf cert:
  61 c5 e7 bb 4a ad 0e 34 37 15 21 85 6b f1 54 1d d6 39 85 48
Full chain:
  d2 0d 42 d5 79 28 59 8f ab 2b 83 15 7d f2 6d 46 57 46 b4 ac
  Issuer: CN=controller2, DC=domain, DC=domain, DC=com
  NotBefore: 6/23/2014 8:32 AM
  NotAfter: 6/16/2016 8:23 AM
  Subject: CN=test.domain.domain.com
  Serial: 141693c100000000003c
  SubjectAltName: DNS Name=test.domain.domain.com
  Template: WebServer
  4c 5a b9 ab 87 80 3e df ed 9a 7f da be 59 d6 98 05 af ab e4
The certificate is revoked. 0x80092010 (-2146885616)
Certificate is REVOKED
Leaf certificate is REVOKED (Reason=4)
CertUtil: -verify command completed successfully.