Why do I see 'Unable to check revocation because the revocation server was offline'?

Question

Hi,
In a lab we've been renewing our Subordinate Issuing CA cert fine for 3 iterations.  On the 4th renewal attempt, when I try to perform a 'Certutil -InstallCet Cert(4).crt, I receive the message 'The revocation function was unable to check revocation
because the revocation server was offline. 0x80092013'.
Why could I perform a renewal operation successfully up to this point but cant now?  What does this message really mean cause no servers are offline?
Thanks for your help! SdeDot

Answer 1

Thanks Paul.
The first error I found in the registry was the DSConfigDN was incorrect due to me copying the commands from another test system. 
We didn't specifically code a CDP or AIA on the Root cause each time we renewed the Cert on the Root, on the Sub CA we published the renewed Cert to AD and added the renewed Cert and renewed CRL to the local Root store.
What follows is the RootCA registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\FlyByNightRootCA:
Keys:
  CSP
  EncryptionCSP
  ExitModules
  PolicyModules
Values:
  ViewAgeMinutes           REG_DWORD = 10 (16)
  ViewIdleMinutes          REG_DWORD = 8
  CAType                   REG_DWORD = 3
    ENUM_STANDALONE_ROOTCA -- 3
  UseDS                    REG_DWORD = 0
  ForceTeletex             REG_DWORD = 12 (18)
    ENUM_TELETEX_AUTO -- 2
    ENUM_TELETEX_UTF8 -- 10 (16)
  SignedAttributes         REG_MULTI_SZ =
    0: RequesterName
  EKUOIDsForPublishExpiredCertInCRL REG_MULTI_SZ =
    0: 1.3.6.1.5.5.7.3.3 Code Signing
    1: 1.3.6.1.4.1.311.61.1.1 Kernel Mode Code Signing
  CommonName               REG_SZ = FlyByNightRootCA
  Enabled                  REG_DWORD = 1
  PolicyFlags              REG_DWORD = 0
  CertEnrollCompatible     REG_DWORD = 0
  CRLEditFlags             REG_DWORD = 100 (256)
    EDITF_ENABLEAKIKEYID -- 100 (256)
  CRLFlags                 REG_DWORD = 2
    CRLF_DELETE_EXPIRED_CRLS -- 2
  InterfaceFlags           REG_DWORD = 41 (65)
    IF_LOCKICERTREQUEST -- 1
    IF_NOREMOTEICERTADMINBACKUP -- 40 (64)
  EnforceX500NameLengths   REG_DWORD = 1
  SubjectTemplate          REG_MULTI_SZ =
    0: EMail
    1: CommonName
    2: OrganizationalUnit
    3: Organization
    4: Locality
    5: State
    6: DomainComponent
    7: Country
  ClockSkewMinutes         REG_DWORD = a (10)
  LogLevel                 REG_DWORD = 3
  HighSerial               REG_DWORD = 0
  CAServerName             REG_SZ = Server03
  ValidityPeriod           REG_SZ = Hours
  ValidityPeriodUnits      REG_DWORD = c (12)
  CAXchgCertHash           REG_MULTI_SZ =
  KRACertHash              REG_MULTI_SZ =
  KRACertCount             REG_DWORD = 0
  KRAFlags                 REG_DWORD = 0
  CRLPublicationURLs       REG_MULTI_SZ =
    0: 65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl
    CSURL_SERVERPUBLISH -- 1
    CSURL_SERVERPUBLISHDELTA -- 40 (64)
    1: 8:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
    CSURL_ADDTOCRLCDP -- 8
    2: 0:http://%1/CertEnroll/%3%8%9.crl
    3: 6:file://%1/CertEnroll/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
  CRLPeriod                REG_SZ = Hours
  CRLPeriodUnits           REG_DWORD = c (12)
  CRLOverlapPeriod         REG_SZ = Hours
  CRLOverlapUnits          REG_DWORD = 0
  CRLDeltaPeriod           REG_SZ = Hours
  CRLDeltaPeriodUnits      REG_DWORD = 0
  CRLDeltaOverlapPeriod    REG_SZ = Minutes
  CRLDeltaOverlapUnits     REG_DWORD = 0
  CAXchgValidityPeriod     REG_SZ = Weeks
  CAXchgValidityPeriodUnits REG_DWORD = 1
  CAXchgOverlapPeriod      REG_SZ = Days
  CAXchgOverlapPeriodUnits REG_DWORD = 1
  MaxIncomingMessageSize   REG_DWORD = 10000 (65536)
  MaxIncomingAllocSize     REG_DWORD = 10000 (65536)
  CACertPublicationURLs    REG_MULTI_SZ =
    0: 1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt
    CSURL_SERVERPUBLISH -- 1
    1: 0:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
    2: 0:http://%1/CertEnroll/%1_%3%4.crt
    3: 2:file://%1/CertEnroll/%1_%3%4.crt
    CSURL_ADDTOCERTCDP -- 2
  CACertHash               REG_MULTI_SZ =
    0: e0 bb 32 b9 bf f7 43 1d 23 e2 da b6 26 10 33 d8 00 61 e6 14
    1: a8 77 c8 09 af f0 07 4c 70 51 78 80 09 26 b1 05 f5 16 e5 be
  Security                 REG_BINARY =
    Allow CA Administrator BUILTIN\Administrators
    Allow Certificate Manager BUILTIN\Administrators
    Allow Enroll Everyone
  SetupStatus              REG_DWORD = 1
    SETUP_SERVER_FLAG -- 1
  DSConfigDN               REG_SZ = CN=Configuration,DC=TestPKI,DC=Net
  AuditFilter              REG_DWORD = 7f (127)
  CRLNextPublish           REG_BINARY = 2/28/2015 4:22 AM
CertUtil: -getreg command completed successfully.
Thanks for your help! SdeDot