Exchange 2010 - Certificate Status Revocation Check Fail

[newpersn]

Just an issue just starting to raise it heads with pupils using OWA

 

When pupils are using webmail we are getting certificate error. Outlook runs fine without error and our SSL is valid til 01/19.

 

Looking in EMC at comes up with that error about our certificate being "The certificate status could not be determined because the revocation check failed"

 

(Just waiting for a screenshot of the error when pupils are accessing there mail)

[Oaktech]

I'm seeing this too with our external certificate. It's a GoDaddy wildcard. I'm hoping when I complete the CSR for a new cert on wednesday it will correct itself. If not, I'll be back!

[newpersn]

I'm seeing this too with our external certificate. It's a GoDaddy wildcard. I'm hoping when I complete the CSR for a new cert on wednesday it will correct itself. If not, I'll be back!

 

Im sure ours is a RapidSSL SHA256 CA - G3

 

(This is unknown area for me. Never had a to mess with a certificate)

[newpersn]

This may be why:

 

https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/

[newpersn]

More annoying. Reseller has sent us new certs and imported in to exchange and still errors with the above...

[Oaktech]

More annoying. Reseller has sent us new certs and imported in to exchange and still errors with the above...

 

Same here. I can only assume it's some sort of internet access issue because I can't see any calls out for a CRL from the server in question. I've yet to try wiresahrk or similar to see if it's actually trying to acquire the CRL. If I just type the CRL URL into IE it downloads successfully.

[newpersn]

Same here. I can only assume it's some sort of internet access issue because I can't see any calls out for a CRL from the server in question. I've yet to try wiresahrk or similar to see if it's actually trying to acquire the CRL. If I just type the CRL URL into IE it downloads successfully.

 

You with EXA?

[Oaktech]

You with EXA?

 

Yes and no - they are our registrar and DNS manager, but not our ISP.

[newpersn]

Yes and no - they are our registrar and DNS manager, but not our ISP.

 

They are both. Our ISP and DNS (although our email get handled though rm still)

 

Would it be wrong to blame DNS on exa side?

 

@exa_mark any ideas?

[newpersn]

Fixed my end. I changed IIS to use the new cert for HTTPS, Since doing that im not getting any errors on OWA. Still getting the check error inside EMC but its working fine.

[Oaktech]

That's exactly what I've done. It's working for me too. It's like it's a bug in ECP

[EXA_Mark]

They are both. Our ISP and DNS (although our email get handled though rm still)

 

Would it be wrong to blame DNS on exa side?

 

@exa_mark any ideas?

 

Hi Newpersn,

 

I'd missed this, has this been sorted? Was it anything our side? PM me if you need anything.

[newpersn]

Hi Newpersn,

 

I'd missed this, has this been sorted? Was it anything our side? PM me if you need anything.

 

Hi Mark.

 

I don’t think so. I’m sure this is a bug of exchange 2010 with the latest roll up installed.

 

It’s working fine since I changed the cert in IIS.