It is generally a good idea to ensure the availability of the Certificate Enrollment Web Services (Certificate Enrollment Policy Web Service, CEP, and Certificate Enrollment Web Service, CES) at all times.
The following describes how this can be achieved with the Windows feature "Network Load Balancing" (NLB).
Assume the following scenario:
The remote endpoint was not reachable. 0x803d0010 (-2143485936 WS_E_ENDPOINT_UNREACHABLE)It is generally a good idea to ensure the availability of the CRL distribution points (CDP), Authority Information Access (AIA), and if available, Online Responders (OCSP) at all times.
Access to the revocation information is even more critical than access to the certification authority itself. If the revocation status of a certificate cannot be checked, it is possible (depending on the application) that the certificate is not considered trustworthy and the associated IT service cannot be used.