Hi everyone!
I have a requirement, where I need to verify the Revocation Status of a Certificate against a CRL issued from the Certificate Authority. This can be done at real time using OCSP by utilizing the command
"Certuitil. exe -verify -urlfetch Certificatepath ".
This works well on Window 7 and Windows Server 2008 R2.
But when we try the same command on Windows Server 2003, the command never returns the status and shows the error below
" The signature of the certificate can not be verified. 0x80096004 (-2146869244)
------------------------------------
CertUtil: -verify command FAILED: 0x80096004 (-2146869244)
CertUtil: The signature of the certificate can not be verified. "
Below is the complete output from the command
Issuer:
CN=<Certificati on Authority>
OU=<Certificati on Authorities>
O=Test LLC.
C=US
Subject:
CN=TestCert-valid
OU=Development
O=Test
L=Minneapolis
S=Minnesota
C=US
Cert Serial Number: 2585178a0000000 0000a
dwFlags = CA_VERIFY_FLAGS _DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVO CATION_CHECK_CH AIN_EXCLUDE_ROO T (0x40000000)
HCCE_LOCAL_MACH INE
CERT_CHAIN_POLI CY_BASE
-------- CERT_CHAIN_CONT EXT --------
ChainContext.dw ErrorStatus = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
ChainContext.dw ErrorStatus = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
ChainContext.dw ErrorStatus = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
ChainContext.dw ErrorStatus = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
SimpleChain.dwE rrorStatus = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
CertContext[0][0]: dwInfoStatus=2 dwErrorStatus=1 000048
Issuer: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Subject: CN=TestSuite1-valid, OU=Development, O=Test, L=Minneapolis, S=Minnesota, C=US
Serial: 2585178a0000000 0000a
Template: 1.3.6.1.4.1.311 .21.8.9714767.7 847860.16731308 .5494905.111262 83.253.11707544 .14004296
8a 98 d5 b6 5d 51 39 bc 62 d6 31 41 5c d9 88 78 f9 cf 0b 32
Element.dwInfoS tatus = CERT_TRUST_HAS_ KEY_MATCH_ISSUE R (0x2)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
Element.dwError Status = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
---------------- Certificate AIA ----------------
Wrong Issuer "Certificat e (0)" Time: 0
[0.0] http://pki.Test.net/repository/STestCA.crt
---------------- Certificate CDP ----------------
Wrong Issuer "Base CRL (108)" Time: 0
[0.0] http://pki.Test.net/repository/STestCA.crl
--------------------------------
Issuance[0] = 1.3.6.1.4.1.375 83.509.50.1.3
Application[0] = 1.3.6.1.5.5.7.3 .2 Client Authentication
Application[1] = 1.3.6.1.5.5.7.3 .1 Server Authentication
CertContext[0][1]: dwInfoStatus=2 dwErrorStatus=1 000048
Issuer: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Subject: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Serial: 110000000861256 00ee5b47c130000 00000008
e7 03 84 0d 47 02 1f 18 06 98 28 81 47 9e 70 58 8c 4d 49 cb
Element.dwInfoS tatus = CERT_TRUST_HAS_ KEY_MATCH_ISSUE R (0x2)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
Element.dwError Status = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
---------------- Certificate AIA ----------------
Wrong Issuer "Certificat e (0)" Time: 0
[0.0] http://pki.Test.net/repository/SSRootCA.crt
---------------- Certificate CDP ----------------
Wrong Issuer "Base CRL (3)" Time: 0
[0.0] http://pki.Test.net/repository/SSRootCA.crl
--------------------------------
CertContext[0][2]: dwInfoStatus=c dwErrorStatus=2 8
Issuer: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Subject: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Serial: 2f9f5fef8094d4a e47303ae9b0c4ac f3
f4 a0 8d ce 8c 1f 46 78 e0 0a ee 18 02 66 83 a2 5b 9c 71 a3
Element.dwInfoS tatus = CERT_TRUST_HAS_ NAME_MATCH_ISSU ER (0x4)
Element.dwInfoS tatus = CERT_TRUST_IS_S ELF_SIGNED (0x8)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
5d 9f a6 3d 01 5a dc 72 9a 2e 37 33 f3 78 ff 81 22 ef 68 f9
Full chain:
4d a4 62 39 07 85 bd c5 7f eb 64 ac ed 64 03 1e 1b 51 d5 96
Issuer: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Subject: CN=TestSuite1-valid, OU=Development, O=Test, L=Minneapolis, S=Minnesota, C=US
Serial: 2585178a0000000 0000a
Template: 1.3.6.1.4.1.311 .21.8.9714767.7 847860.16731308 .5494905.111262 83.253.11707544 .14004296
8a 98 d5 b6 5d 51 39 bc 62 d6 31 41 5c d9 88 78 f9 cf 0b 32
The signature of the certificate can not be verified. 0x80096004 (-2146869244)
------------------------------------
CertUtil: -verify command FAILED: 0x80096004 (-2146869244)
CertUtil: The signature of the certificate can not be verified.
If anyone knows how to use Certutil command line tool on Windows server 2003 to verify the certificate revocation status using OCSP, Please Help.
Any help is greatly appreciated.
Thanks a lot in advance.
Vinay
I have a requirement, where I need to verify the Revocation Status of a Certificate against a CRL issued from the Certificate Authority. This can be done at real time using OCSP by utilizing the command
"Certuitil. exe -verify -urlfetch Certificatepath ".
This works well on Window 7 and Windows Server 2008 R2.
But when we try the same command on Windows Server 2003, the command never returns the status and shows the error below
" The signature of the certificate can not be verified. 0x80096004 (-2146869244)
------------------------------------
CertUtil: -verify command FAILED: 0x80096004 (-2146869244)
CertUtil: The signature of the certificate can not be verified. "
Below is the complete output from the command
Issuer:
CN=<Certificati on Authority>
OU=<Certificati on Authorities>
O=Test LLC.
C=US
Subject:
CN=TestCert-valid
OU=Development
O=Test
L=Minneapolis
S=Minnesota
C=US
Cert Serial Number: 2585178a0000000 0000a
dwFlags = CA_VERIFY_FLAGS _DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVO CATION_CHECK_CH AIN_EXCLUDE_ROO T (0x40000000)
HCCE_LOCAL_MACH INE
CERT_CHAIN_POLI CY_BASE
-------- CERT_CHAIN_CONT EXT --------
ChainContext.dw ErrorStatus = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
ChainContext.dw ErrorStatus = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
ChainContext.dw ErrorStatus = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
ChainContext.dw ErrorStatus = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
SimpleChain.dwE rrorStatus = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
SimpleChain.dwE rrorStatus = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
CertContext[0][0]: dwInfoStatus=2 dwErrorStatus=1 000048
Issuer: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Subject: CN=TestSuite1-valid, OU=Development, O=Test, L=Minneapolis, S=Minnesota, C=US
Serial: 2585178a0000000 0000a
Template: 1.3.6.1.4.1.311 .21.8.9714767.7 847860.16731308 .5494905.111262 83.253.11707544 .14004296
8a 98 d5 b6 5d 51 39 bc 62 d6 31 41 5c d9 88 78 f9 cf 0b 32
Element.dwInfoS tatus = CERT_TRUST_HAS_ KEY_MATCH_ISSUE R (0x2)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
Element.dwError Status = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
---------------- Certificate AIA ----------------
Wrong Issuer "Certificat e (0)" Time: 0
[0.0] http://pki.Test.net/repository/STestCA.crt
---------------- Certificate CDP ----------------
Wrong Issuer "Base CRL (108)" Time: 0
[0.0] http://pki.Test.net/repository/STestCA.crl
--------------------------------
Issuance[0] = 1.3.6.1.4.1.375 83.509.50.1.3
Application[0] = 1.3.6.1.5.5.7.3 .2 Client Authentication
Application[1] = 1.3.6.1.5.5.7.3 .1 Server Authentication
CertContext[0][1]: dwInfoStatus=2 dwErrorStatus=1 000048
Issuer: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Subject: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Serial: 110000000861256 00ee5b47c130000 00000008
e7 03 84 0d 47 02 1f 18 06 98 28 81 47 9e 70 58 8c 4d 49 cb
Element.dwInfoS tatus = CERT_TRUST_HAS_ KEY_MATCH_ISSUE R (0x2)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_REVO CATION_STATUS_U NKNOWN (0x40)
Element.dwError Status = CERT_TRUST_IS_O FFLINE_REVOCATI ON (0x1000000)
---------------- Certificate AIA ----------------
Wrong Issuer "Certificat e (0)" Time: 0
[0.0] http://pki.Test.net/repository/SSRootCA.crt
---------------- Certificate CDP ----------------
Wrong Issuer "Base CRL (3)" Time: 0
[0.0] http://pki.Test.net/repository/SSRootCA.crl
--------------------------------
CertContext[0][2]: dwInfoStatus=c dwErrorStatus=2 8
Issuer: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Subject: CN=Test Root Certification Authority, OU=Test Certification Authories, O=Test LLC., C=US
Serial: 2f9f5fef8094d4a e47303ae9b0c4ac f3
f4 a0 8d ce 8c 1f 46 78 e0 0a ee 18 02 66 83 a2 5b 9c 71 a3
Element.dwInfoS tatus = CERT_TRUST_HAS_ NAME_MATCH_ISSU ER (0x4)
Element.dwInfoS tatus = CERT_TRUST_IS_S ELF_SIGNED (0x8)
Element.dwError Status = CERT_TRUST_IS_N OT_SIGNATURE_VA LID (0x8)
Element.dwError Status = CERT_TRUST_IS_U NTRUSTED_ROOT (0x20)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
--------------------------------
Exclude leaf cert:
5d 9f a6 3d 01 5a dc 72 9a 2e 37 33 f3 78 ff 81 22 ef 68 f9
Full chain:
4d a4 62 39 07 85 bd c5 7f eb 64 ac ed 64 03 1e 1b 51 d5 96
Issuer: CN=Test Issuing Certification Authority, OU=Test Certification Authorities, O=Test LLC., C=US
Subject: CN=TestSuite1-valid, OU=Development, O=Test, L=Minneapolis, S=Minnesota, C=US
Serial: 2585178a0000000 0000a
Template: 1.3.6.1.4.1.311 .21.8.9714767.7 847860.16731308 .5494905.111262 83.253.11707544 .14004296
8a 98 d5 b6 5d 51 39 bc 62 d6 31 41 5c d9 88 78 f9 cf 0b 32
The signature of the certificate can not be verified. 0x80096004 (-2146869244)
------------------------------------
CertUtil: -verify command FAILED: 0x80096004 (-2146869244)
CertUtil: The signature of the certificate can not be verified.
If anyone knows how to use Certutil command line tool on Windows server 2003 to verify the certificate revocation status using OCSP, Please Help.
Any help is greatly appreciated.
Thanks a lot in advance.
Vinay