{"id":1678,"date":"2012-04-30T13:06:07","date_gmt":"2012-04-30T17:06:07","guid":{"rendered":"http:\/\/www.bhargavs.com\/?p=388"},"modified":"2012-04-30T13:06:07","modified_gmt":"2012-04-30T17:06:07","slug":"certificate-revocation-checked-failed","status":"publish","type":"post","link":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/","title":{"rendered":"Certificate revocation checked failed"},"content":{"rendered":"

Recently I came across a CAS server that was rebuilt. Think of it as a new server you are introducing in your environment.<\/p>\n

 <\/p>\n

Everything looked good except certificate that we imported. The certificate looked good when looking at validity, issuing authority certificate and other dependencies. However, Exchange Management Console complained:<\/p>\n

\n

\u201cThe certificate status could not be determined because the revocation checked failed.\u201d<\/p>\n<\/blockquote>\n

Since the error seemed clear enough, we checked and verified that we can reach CRL. We could successfully access it and download CRL. We also ensured that there was no proxy servers configured or required, which they weren\u2019t.<\/p>\n

However, the server had its own mind.<\/p>\n

KB979694<\/a> wasn\u2019t applicable since there was no proxy in the environment.<\/p>\n

The only logical thinking here was, why is \u201cLocal System\u201d account (which the service uses to get the revocation status) unable to get to CRL. To get to the answer, we needed to check proxy settings of Local System account. How do you do that? You can\u2019t simply start IE as different user!<\/p>\n

That exactly is the purpose of this post. I found bits and pieces of information that helped me resolve the issue but not a one step document. In this post, I am trying to put it all together so you have one stop solution.<\/p>\n

Here\u2019s how you can fix the issue:<\/p>\n

    \n
  1. Open up command prompt as Administrator<\/li>\n
  2. Run \u201csc create testsvc binpath= "cmd \/K start" type= own type= interact\u201d<\/li>\n
      \n
    • This creates testsvc service which will run as local system and allow interaction with desktop<\/li>\n<\/ul>\n
    • Run \u201csc start testsvc\u201d<\/li>\n
        \n
      • The error \u201c[SC] StartService failed 1053\u201d is expected and can be ignored safely<\/li>\n<\/ul>\n
      • Locate \u201cInteractive Services Detection\u201d icon blinking in the taskbar and click \u201cview message\u201d<\/li>\n
      • You are now in a command prompt window running as Local System and you will not see your desktop. The only other visible window is \u201cInteractive Services Detection\u201d window.<\/li>\n
      • Launch Internet Explorer using the following command:<\/li>\n
          \n
        • "c:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"<\/li>\n<\/ul>\n
        • Internet Explorer may present Set up window. If it does, click \u201cAsk me later\u201d.<\/li>\n
        • We will now check proxy settings. Go to Tools -> Internet options -> Connections -> Lan Settings.<\/li>\n
        • Verify proxy and automatic configuration options and change them to match your environment. In my case we cleared all checkboxes since no proxy existed in environment. <\/li>\n
            \n
          • In our case, either server build process or a setting from or a GPO was populating incorrect proxy settings.<\/li>\n<\/ul>\n
          • Close Internet Explorer window and return to command prompt.<\/li>\n
          • We will now clean certutil caches.<\/li>\n
          • Run \u201ccertutil -urlcache ocsp delete\u201d<\/li>\n
          • Run \u201ccertutil -urlcache crl delete\u201d<\/li>\n
          • We\u2019re almost done here. We now have to close and exit out of service.<\/li>\n
          • Type \u201cexit\u201d and press enter to close command prompt that is running as Local System.<\/li>\n
          • Now you should have only one \u201cInteractive Services Detection\u201d window.<\/li>\n
          • Click \u201cReturn Now\u201d.<\/li>\n<\/ol>\n

            You are now back to your desktop and we have corrected Internet Explorer settings for Local System (removing proxy configuration that was incorrect). After this, we restarted Exchange Management Console and verified certificate on CAS server in question. Certificate was no longer issuing the warning and we proceeded with assigning the certificate to appropriate services.<\/p>\n

            It is important to note that refresh time varies from immediate to more than few minutes so don\u2019t fret over certificate still showing the same error. If, however, it takes more than 15 minutes, I would check if all steps were followed as mentioned above and configuration is correct for your environment.<\/p>\n

            Yet another issue put to bed. On to another.<\/p>\n

            Originally posted at http:\/\/blogs.technet.com\/bshukla<\/p>\n","protected":false},"excerpt":{"rendered":"

            Recently I came across a CAS server that was rebuilt. Think of it as a new server you are introducing in your environment.   Everything looked good except certificate that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pgc_sgb_lightbox_settings":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[52],"tags":[],"class_list":["post-1678","post","type-post","status-publish","format-standard","hentry","category-exchange-2010"],"yoast_head":"\nCertificate revocation checked failed - Bhargav's IT Playground<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Certificate revocation checked failed - Bhargav's IT Playground\" \/>\n<meta property=\"og:description\" content=\"Recently I came across a CAS server that was rebuilt. Think of it as a new server you are introducing in your environment.   Everything looked good except certificate that […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/\" \/>\n<meta property=\"og:site_name\" content=\"Bhargav's IT Playground\" \/>\n<meta property=\"article:published_time\" content=\"2012-04-30T17:06:07+00:00\" \/>\n<meta name=\"author\" content=\"Bhargav\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bhargav\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/\"},\"author\":{\"name\":\"Bhargav\",\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#\\\/schema\\\/person\\\/28f6d8c9b29f3a879483d65fc2ab5e26\"},\"headline\":\"Certificate revocation checked failed\",\"datePublished\":\"2012-04-30T17:06:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/\"},\"wordCount\":611,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#\\\/schema\\\/person\\\/28f6d8c9b29f3a879483d65fc2ab5e26\"},\"articleSection\":[\"Exchange 2010\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/\",\"url\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/\",\"name\":\"Certificate revocation checked failed - Bhargav's IT Playground\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#website\"},\"datePublished\":\"2012-04-30T17:06:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/bhargavs.com\\\/index.php\\\/2012\\\/04\\\/30\\\/certificate-revocation-checked-failed\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/bhargavs.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Certificate revocation checked failed\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#website\",\"url\":\"https:\\\/\\\/bhargavs.com\\\/\",\"name\":\"Bhargav's IT Playground\",\"description\":\"Passion for Technology. Power of Collaboration.\",\"publisher\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#\\\/schema\\\/person\\\/28f6d8c9b29f3a879483d65fc2ab5e26\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/bhargavs.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#\\\/schema\\\/person\\\/28f6d8c9b29f3a879483d65fc2ab5e26\",\"name\":\"Bhargav\",\"logo\":{\"@id\":\"https:\\\/\\\/bhargavs.com\\\/#\\\/schema\\\/person\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/bhargavs.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Certificate revocation checked failed - Bhargav's IT Playground","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/","og_locale":"en_US","og_type":"article","og_title":"Certificate revocation checked failed - Bhargav's IT Playground","og_description":"Recently I came across a CAS server that was rebuilt. Think of it as a new server you are introducing in your environment.   Everything looked good except certificate that […]","og_url":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/","og_site_name":"Bhargav's IT Playground","article_published_time":"2012-04-30T17:06:07+00:00","author":"Bhargav","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Bhargav","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/#article","isPartOf":{"@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/"},"author":{"name":"Bhargav","@id":"https:\/\/bhargavs.com\/#\/schema\/person\/28f6d8c9b29f3a879483d65fc2ab5e26"},"headline":"Certificate revocation checked failed","datePublished":"2012-04-30T17:06:07+00:00","mainEntityOfPage":{"@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/"},"wordCount":611,"commentCount":0,"publisher":{"@id":"https:\/\/bhargavs.com\/#\/schema\/person\/28f6d8c9b29f3a879483d65fc2ab5e26"},"articleSection":["Exchange 2010"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/","url":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/","name":"Certificate revocation checked failed - Bhargav's IT Playground","isPartOf":{"@id":"https:\/\/bhargavs.com\/#website"},"datePublished":"2012-04-30T17:06:07+00:00","breadcrumb":{"@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/bhargavs.com\/index.php\/2012\/04\/30\/certificate-revocation-checked-failed\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/bhargavs.com\/"},{"@type":"ListItem","position":2,"name":"Certificate revocation checked failed"}]},{"@type":"WebSite","@id":"https:\/\/bhargavs.com\/#website","url":"https:\/\/bhargavs.com\/","name":"Bhargav's IT Playground","description":"Passion for Technology. Power of Collaboration.","publisher":{"@id":"https:\/\/bhargavs.com\/#\/schema\/person\/28f6d8c9b29f3a879483d65fc2ab5e26"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/bhargavs.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/bhargavs.com\/#\/schema\/person\/28f6d8c9b29f3a879483d65fc2ab5e26","name":"Bhargav","logo":{"@id":"https:\/\/bhargavs.com\/#\/schema\/person\/image\/"},"sameAs":["https:\/\/bhargavs.com"]}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":150,"url":"https:\/\/bhargavs.com\/index.php\/2009\/07\/11\/exchange-2007-rollup-update-installation-hang-managed-code-services-do-not-start\/","url_meta":{"origin":1678,"position":0},"title":"Disable Certificate Revocation Check","author":"Bhargav","date":"July 11, 2009","format":false,"excerpt":"If your Exchange 2007 servers are not connected to internet (which for most cases should be true), installation of Rollup Update can hang and\/or Exchange 2007 managed code services do not start. This happens due to Certificate Revocation check for certificate used to sign the code. It is documented here\u2026","rel":"","context":"In "Exchange 2007"","block_context":{"text":"Exchange 2007","link":"https:\/\/bhargavs.com\/index.php\/category\/microsoft\/exchange-server\/exchange-2007\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1651,"url":"https:\/\/bhargavs.com\/index.php\/2010\/04\/07\/how-to-install-update-rollups-remotely-on-exchange-2010-server\/","url_meta":{"origin":1678,"position":1},"title":"How to install Update Rollups remotely on Exchange 2010 server","author":"Bhargav","date":"April 7, 2010","format":false,"excerpt":"If you are like me, you are always looking for ways to not leave your chair, or for that matter, not switch windows. When it comes to install Update Rollups on every Exchange 2010 server you have, the same applies. So I set out to find a way and I\u2026","rel":"","context":"In "Exchange 2010"","block_context":{"text":"Exchange 2010","link":"https:\/\/bhargavs.com\/index.php\/category\/microsoft\/exchange-server\/exchange-2010\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1696,"url":"https:\/\/bhargavs.com\/index.php\/2013\/05\/15\/how-to-load-balance-office-web-apps-server-2013-farm\/","url_meta":{"origin":1678,"position":2},"title":"How to load balance Office Web Apps Server 2013 farm","author":"Bhargav","date":"May 15, 2013","format":false,"excerpt":"In my previous post, I showed how to create an Office Web Apps Server 2013 farm. Since I can\u2019t leave you hanging, I am going to show you the next step of setting up a load balancer for the same. I assume you have created DNS entry for owaps.contoso.com and\u2026","rel":"","context":"In "Load Balancing"","block_context":{"text":"Load Balancing","link":"https:\/\/bhargavs.com\/index.php\/category\/technology\/load-balancing\/"},"img":{"alt_text":"image","src":"https:\/\/i0.wp.com\/bhargavs.com\/wp-content\/uploads\/2013\/05\/image_thumb2.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1646,"url":"https:\/\/bhargavs.com\/index.php\/2010\/03\/05\/charter-member-of-mcitp-enterprise-messaging-administrator-exchange-2010\/","url_meta":{"origin":1678,"position":3},"title":"Charter Member of MCITP: Enterprise Messaging Administrator Exchange 2010","author":"Bhargav","date":"March 5, 2010","format":false,"excerpt":"I just came to know that I am a \u201cCharter Member\u201d of MCITP: Enterprise Messaging Administrator 2010. It is interesting because I took exams when they were in Beta stage and knew I would be one of the first few, however, when I got certificate from MCP site right after\u2026","rel":"","context":"In "General"","block_context":{"text":"General","link":"https:\/\/bhargavs.com\/index.php\/category\/general\/"},"img":{"alt_text":"MCITP-2010-Charter","src":"https:\/\/i0.wp.com\/www.bhargavs.com\/wp-content\/uploads\/2010\/03\/mcitp2010charter-thumb.jpg?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.bhargavs.com\/wp-content\/uploads\/2010\/03\/mcitp2010charter-thumb.jpg?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.bhargavs.com\/wp-content\/uploads\/2010\/03\/mcitp2010charter-thumb.jpg?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.bhargavs.com\/wp-content\/uploads\/2010\/03\/mcitp2010charter-thumb.jpg?resize=700%2C400 2x"},"classes":[]},{"id":235,"url":"https:\/\/bhargavs.com\/index.php\/2010\/01\/21\/what-does-new-exchangecertificate-confirm-do\/","url_meta":{"origin":1678,"position":4},"title":"What does New-ExchangeCertificate \u2013confirm do?","author":"Bhargav","date":"January 21, 2010","format":false,"excerpt":"Depends who is asking. Let\u2019s assume a scenario where you are trying to create a new self-signed certificate on Exchange 2007 using a script. You run the command \u201cNew-Exchange Certificate \u2013 Services \u201cIMAP, POP3, IIS, SMTP\u201d \u2013Confirm:$false\u201d. The script stops at a prompt when it tries to confirm overwrite of\u2026","rel":"","context":"In "Exchange 2007"","block_context":{"text":"Exchange 2007","link":"https:\/\/bhargavs.com\/index.php\/category\/microsoft\/exchange-server\/exchange-2007\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":721,"url":"https:\/\/bhargavs.com\/index.php\/2014\/03\/17\/ignoring-ssl-trust-in-powershell-using-system-net-webclient\/","url_meta":{"origin":1678,"position":5},"title":"Ignoring SSL Trust in PowerShell using System.Net.WebClient","author":"Bhargav","date":"March 17, 2014","format":false,"excerpt":"This article was originally posted on my PFE blog here: http:\/\/blogs.technet.com\/b\/bshukla\/archive\/2012\/08\/22\/3324650.aspx. I noticed a few inaccuracies with the article and since I am not a PFE anymore, I can\u2019t edit original article but posting updated article here for everyone to benefit from. The Problem We all at one point or\u2026","rel":"","context":"In "PowerShell"","block_context":{"text":"PowerShell","link":"https:\/\/bhargavs.com\/index.php\/category\/microsoft\/powershell\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_shortlink":"https:\/\/wp.me\/pkROc-r4","_links":{"self":[{"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/posts\/1678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/comments?post=1678"}],"version-history":[{"count":0,"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/posts\/1678\/revisions"}],"wp:attachment":[{"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/media?parent=1678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/categories?post=1678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bhargavs.com\/index.php\/wp-json\/wp\/v2\/tags?post=1678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}