From time to time, I can't verify the expiration of my client certificate on IIS.

Question

I have a IIS web server and a CA(AD CS) server built on a 2008R2 virtual machine.
I require a client certificate in order to access the web server.
It works very well but FROM TIME TO TIME, a 403 error code is returned.
According to the trace log(FailedReqLogFiles), a 0x80092013 error occurs.
Once this 403 error occurs, it last for about an hour and then everything goes back to normal.
In order to find out what is the problem, I have done setup:
- CRL has a publication time of 1 hour
- (Delta CRL) has a publication time of 30minutes.
also:
- Both web server and CA server are not on a domain but a workgroup
- The CA certificate is registered on the web server & client on the root & intermediate certificate registrar.
- Both setups are patched to the latest windows update
As far as I've checked the log:
- on the web server log(source: CAPI2), there is an event id 53 at almost every hour for both the CRL & delta CRL
but before the problem occurs the event id 53 is only reported on the delta CRL and nothing on the CRL.
- By the way, System32\config\systemprofile\AppData\LocalLow\Microsoft\X509Objects, the .crl file for the problematic update is only present on the delta CRL.
- On the CA server's IIS access log, there is just the delta CRL access that is registered.
- Below is the log on the CA server IIS's access log (XXX-CA is for anonymous sake):
2014-04-16 10:51:34 fe80::f99a:eb13:7c7b:1de4%10 GET /CertEnroll/XXX-CA(1).crl - 80 - fe80::7993:d27a:af9f:170%10 Microsoft-CryptoAPI/6.1 200 0 0 218
2014-04-16 10:51:39 fe80::f99a:eb13:7c7b:1de4%10 GET /CertEnroll/XXX-CA(1)+.crl - 80 - fe80::7993:d27a:af9f:170%10 Microsoft-CryptoAPI/6.1 200 0 0 202
2014-04-16 11:52:05 fe80::f99a:eb13:7c7b:1de4%10 GET /CertEnroll/XXX-CA(1)+.crl - 80 - fe80::7993:d27a:af9f:170%10 Microsoft-CryptoAPI/6.1 200 0 0 265
2014-04-16 12:52:22 fe80::f99a:eb13:7c7b:1de4%10 GET /CertEnroll/XXX-CA(1).crl - 80 - fe80::7993:d27a:af9f:170%10 Microsoft-CryptoAPI/6.1 200 0 0 218
2014-04-16 12:52:28 fe80::f99a:eb13:7c7b:1de4%10 GET /CertEnroll/XXX-CA(1)+.crl - 80 - fe80::7993:d27a:af9f:170%10 Microsoft-CryptoAPI/6.1 200 0 0 202
- I think that the 403 error is due to the fact this CRL is not getting reached but why would this happen?
- Is there an other way than to restart the OS in order to clear this problem in a shorter time than 1 hour?
side note:
- this problem happens on the client setup too.
- the log is shorten but if there is any filter to apply to get better information, please tell me.
I would appreciate any helps on this matter!
nb:
this is a translation from a Japanese text.

Answer 1

Hi,
The error message will occur if IIS cannot download CRLs of the client certificate, in other words, if the CA is shut down or there are network connectivity issues between web server and CA when Internet Information Services try
to download the client certificate’s CRL.
Therefore, please make sure that there is no network connectivity issue between the web server and CA, you can
find the IP address of the problem CDP server then add an entry to the HOSTS file on the IIS computer.
Here are some related KB articles below I suggest you refer to:
IIS returns HTTP "403.13 Client Certificate Revoked" error message although certificate is not revoked
http://support.microsoft.com/kb/294305/en-us
You receive a "403.13 client certificate revoked" error message when you connect to a computer that is running Windows Server 2003 and Internet Information Services 6.0
http://support.microsoft.com/kb/884115/en-us
Best Regards,
Amy