1

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem

And I have exported the CRL to that location, and I confirmed it's visible on the network.

Now, when I issue certificates (in this case for exchange), it accepts the cert but says revocation check failure. Using the certuil it suggests that the CRL information is missing from the leaf certificate. (See output of certutil of a leaf certificate below). Similarly, certutil says my CA's certificate has no CRL URL's.

Why are my CA and leaf certificates missing CRL URL's? When I view the CA details in Tiny CA, it shows Netscape CA revocation URL as http://myserver.com/crl.pem as originally entered.

Issuer:
    CN=My Company
    C=CA
  Name Hash(sha1): b6b02cfd24a47572f68a85a398322f978989d9ef
  Name Hash(md5): 5333e962243f00751ee6fcf5b62973b9
Subject:
    C=CA
    S=State
    L=City
    O=mydomain
    OU=IT4
    CN=newmail.mydomain.com
  Name Hash(sha1): 1a7840c8a10059e8e2b87e32f32426dd6ad3d60a
  Name Hash(md5): 1b0581a411b0c14d057203950e3aca98
Cert Serial Number: 04

dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

CertContext[0][0]: dwInfoStatus=101 dwErrorStatus=40
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 9:45 PM
  NotAfter: 2/26/2026 9:45 PM
  Subject: C=CA, S=State, L=City, O=mydomain, OU=IT4, CN=newmail.mydomain.com
  Serial: 04
  SubjectAltName: No alternative name
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
  Element.dwInfoStatus = CERT_TRUST_HAS_EXACT_MATCH_ISSUER (0x1)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  --------------------------------

CertContext[0][1]: dwInfoStatus=109 dwErrorStatus=0
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 8:17 PM
  NotAfter: 2/26/2026 8:17 PM
  Subject: CN=My Company, C=CA
  Serial: 86278a3832426d41
  SubjectAltName: No alternative name
  353c6f365f9d7b2e623b7c228e937adac5ee3a2b
  Element.dwInfoStatus = CERT_TRUST_HAS_EXACT_MATCH_ISSUER (0x1)
  Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
  Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
  ----------------  Certificate AIA  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0
  ----------------  Certificate OCSP  ----------------
  No URLs "None" Time: 0
  --------------------------------

Exclude leaf cert:
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
Full chain:
  b8408cac425b1604c28a619181394d7f057607e0
  Issuer: CN=My Company, C=CA
  NotBefore: 2/29/2016 9:45 PM
  NotAfter: 2/26/2026 9:45 PM
  Subject: C=CA, S=State, L=City, O=mydomain, OU=IT4, CN=newmail.mydomain.com
  Serial: 04
  SubjectAltName: No alternative name
  06a85bf14f2747b8cd2c2c4be5bb5ae945f94ed9
The revocation function was unable to check revocation for the certificate. 0x80
092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK)
------------------------------------
Revocation check skipped -- no revocation information available
Cert is an End Entity certificate
Cannot check leaf certificate revocation status
CertUtil: -verify command completed successfully.
1

CRL download URL cannot be guessed; systems that validate certificates must find these URL somewhere. In a certificate, the URL for the CRL that talks about it is found in a CRL Distribution Points extension. When certutil shoes this:

  ----------------  Certificate CDP  ----------------
  No URLs "None" Time: 0

it is really telling you that there is no CDP in the certificate.


A root certificate is a certificate that is trusted a priori by the system. By definition, it cannot be revoked: revocation is a status proclaimed by the super-CA that issued the certificate, and a root certificate was not issued by any super-CA. It just is. Therefore, it is normal and expected that a root certificate does not include a CDP.

Note that when a CA issues (signs) certificates and CRL, it puts the CRL download URL in the certificates it creates. The CA own certificate does not reference that CRL.

If TinyCA does not add the relevant URL in the non-root certificates that it issues, then either it was misconfigured (you did not provide the information), or it is bad software. Speaking of which, it seems abandoned: the references I found speak of a last version published in 2005, on a site which has since disappeared.

  • I realize TinyCA is getting a bit old - but it's still popular so hopefully it's not a major bug. In terms of WHY tinyCA isn't including the CRL URL in the CDP - that is the question. I entered the CRL URL exactly as noted above when creating the CA. Is that all that's needed? (This is TinyCA specific obviously). Should just clicking SIGN for a CSR cause TinyCA to insert the CRL URL used when creating the ca? – TSG Mar 1 '16 at 15:27
  • "Netscape CA revocation URL" is reminiscent of the old Netscape-specific extensions that are not the standard extension (such as CDP), and are simply ignored by most modern software. Maybe the URL was stored in the wrong place in the certificate. – Tom Leek Mar 1 '16 at 15:31
  • Sadly few CA gui's are prebuilt for RH/Centos6. TinyCA is the only one. 2 popular ones don't compile under Centos6. But I think XCA will work - I'll update question if that results in certs with CDP / CRL URL. – TSG Mar 1 '16 at 20:03
  • For anyone else with this problem: TinyCA doesn't add CRL URL's to the certificates. It's too old. Try XCA instead - I confirmed that works. (certs without CRL seem ok for my Linux hosts, but not windows hosts) – TSG Mar 1 '16 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.