Logon via smart card fails with error message "The revocation status of the authentication certificate could not be determined."

Author Uwe Gradenegger Posted on Categories Certificate usage Tags Domain controller, Smart card logon

Assume the following scenario:

  • A user has a Smartcard Logon certificate and uses it to log on to the Active Directory domain.
  • The logon fails. The following error message is returned to the user on their computer:
The revocation status of the authentication certificate could not be determined.

In German, the message reads:

Der Sperrstatus des für die Authentifizierung verwendeten Smartcard-Zertifikats konnte nicht ermittelt werden.

A corresponding event should also be logged on the authenticating domain controller that processed the logon:

Possible causes

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

Problems with the CRL distribution points (availability and freshness of the certificate revocation lists) can affect any certificate in the certificate chain being checked, for example also when the certificate revocation list of a certification authority in the chain has expired (classically the root certification authority whose CRL renewal was missed).

If the certificate revocation list of the root certification authority has expired, a common follow-up error is that subordinate certification authorities no longer start , as they check the validity of their own certification authority certificate when the service starts.