What does HRESULT 0x80090353 (SEC_E_REVOCATION_OFFLINE_C) mean?

 
Previous Next
SEC_E_ISSUING_CA_UNTRUSTED SEC_E_PKINIT_CLIENT_FAILURE

SEC_E_REVOCATION_OFFLINE_C

Which validation path failed

This status concerns the user certificate presented from the smart card during PKINIT. The domain controller must establish whether that certificate and the issuing chain are still valid for logon. It is not a finding that the certificate is revoked; it means the revocation result could not be obtained or accepted.

That distinction matters. SEC_E_SMARTCARD_CERT_REVOKED identifies a positive revocation result. SEC_E_REVOCATION_OFFLINE_C instead points to the infrastructure used to establish certificate status: CRL Distribution Points, an OCSP responder where applicable, the current CRL data, or the ability of the domain controller to reach and validate those sources.

What to examine on the domain controller

  • Inspect the exact smart card certificate and every non-root CA certificate in its chain. Record their CRL Distribution Point and Authority Information Access locations rather than testing only the leaf certificate.
  • Test access to each publication point from the domain controller security context and network path. A CRL URL that works from an administrator workstation can still be blocked from the DC by DNS, proxy, firewall, TLS inspection, or routing policy.
  • Check that the retrieved CRL is correctly signed, applies to the issuing CA, and is current. An old CRL whose nextUpdate has passed is not a usable proof that the certificate remains valid.
  • Check time synchronization on the workstation, the domain controller, and CA infrastructure before changing certificate templates or account mappings.

Do not treat disabling revocation checks as a production repair. It changes the trust decision instead of restoring the evidence that the certificate has not been revoked.

References

Looking for a different code? Search another status or error code.