What does NTSTATUS 0xC000038B (STATUS_REVOCATION_OFFLINE_C) mean?

 
Previous Next
STATUS_ISSUING_CA_UNTRUSTED STATUS_PKINIT_CLIENT_FAILURE

STATUS_REVOCATION_OFFLINE_C

Unknown revocation status is different from a certificate that is positively known to be revoked

STATUS_REVOCATION_OFFLINE_C indicates that revocation status for the authentication certificate could not be determined. Windows certificate-chain processing can retrieve certificate revocation lists and OCSP-related data, and X.509 PKI defines CRL distribution information as part of certificate validation. Network retrieval and cache state can therefore be part of authentication success.

This page is distinct from STATUS_REVOCATION_OFFLINE_KDC, which points specifically at KDC certificate revocation in a Kerberos/PKINIT path. For the generic client-certificate status, capture the exact certificate chain and identify which certificate’s revocation check is offline. Test each CRL distribution point or OCSP path from the machine and security context performing authentication, not only from an administrator workstation.

Do not disable revocation checking globally as a connectivity workaround. Check proxy configuration, DNS, firewall egress, CRL validity periods, stale cached data, and CA publication health. Also distinguish "offline" from "revoked": replacing a certificate is appropriate when it is revoked, but an offline status requires restoring trustworthy revocation information or correcting the chain configuration.

What to inspect

  • The complete certificate chain and the specific chain element whose revocation status could not be determined.
  • CRL distribution points, OCSP/AIA retrieval paths, proxy and firewall behavior from the authenticating machine.
  • CRL/OCSP freshness, CA publication health, and whether the failure changes after cache-only versus network-enabled validation.

References

Looking for a different code? Search another status or error code.