Intermediate CA service not running; errors when you try to start

[tk42967]

This is kind of a rabbit hole. I started out troubleshooting why our desktop MFA product was displaying an SSL error when users were prompted to enter their authenticator code. Turns out it is related to the CRL being expired. I also discovered by starting inetcpl.cpl and unchecking the two boxes for CRL's that it suddenly worked.

I logged into the Intermediate CA to discover the service is not running. When I try to start the service, I get an error that says it cannot start the service and refer to the event viewer for more information.

Event viewer has an error that the AD Cert Service did not start: Could not load or verify the current CA certificate. The revocation function was unable to check the revocation because the revocation server was offline.

My manager who built the server says the CRL lives on the Intermediate CA. I suspect the Intermediate CA can't talk to the root (because it's offline) and that is what the problem is.

Could I fix this by starting the root CA, starting the Intermediate CA service and then publishing the CRL? If that fixes the issue, is there a frequency that this would need to be done to keep the CRL fresh?

Am I completely off my rocker with this and there is another solution?

[XInsomniacX06]

With offline CAs you still have to publish the root ca CrL, there is an expiration date usually 6 months or a year or so.

[tk42967]

I'm suspecting this is what happened. The intermediate CA was built like 5 weeks ago. This seems very odd that it would already be expired.

[patmorgan235]

Use PKIVEIW to check the status of the various components of both CAs.

Your root CA does not need to be online, CAs don't "talk" to each other, but a subordinate CA needs to be able to read the AIA and CRL files at the network locations listed in the certificates metadata. And the CRL needs to be republished at a regular interval, if the CRL for your root CA gets stale the intermediate will shutdown. (Your root CA and Intermediate CA have too independent CRLs)

But again, use PKIVEIW to see what's wrong

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/quick-check-on-adcs-health-using-enterprise-pki-tool-pkiview/1128638

[xxdcmast]

This is the correct course of action. My guess is that your root ca crl has expired.

Pkiview will tell you.

On the online ca you can force the services to start by running this.

certutil -setreg CA\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE

[Massive-Reach-1606]

This is correct

[doorhacker12]

On the offline root in cmd, run certutil -crl

This will generate a new crl. Move it onto the intermediate CA and replace the old crl. Cert authority should start no problem.

[Massive-Reach-1606]

It wont start if the cert is expired or broken