| Previous | Next |
| STATUS_ISSUING_CA_UNTRUSTED | STATUS_PKINIT_CLIENT_FAILURE |
STATUS_REVOCATION_OFFLINE_C
Unknown revocation status is different from a certificate that is positively known to be revoked
STATUS_REVOCATION_OFFLINE_C indicates that revocation status for the authentication certificate could not be determined. Windows certificate-chain processing can retrieve certificate revocation lists and OCSP-related data, and X.509 PKI defines CRL distribution information as part of certificate validation. Network retrieval and cache state can therefore be part of authentication success.
This page is distinct from STATUS_REVOCATION_OFFLINE_KDC, which points specifically at KDC certificate revocation in a Kerberos/PKINIT path. For the generic client-certificate status, capture the exact certificate chain and identify which certificate’s revocation check is offline. Test each CRL distribution point or OCSP path from the machine and security context performing authentication, not only from an administrator workstation.
Do not disable revocation checking globally as a connectivity workaround. Check proxy configuration, DNS, firewall egress, CRL validity periods, stale cached data, and CA publication health. Also distinguish "offline" from "revoked": replacing a certificate is appropriate when it is revoked, but an offline status requires restoring trustworthy revocation information or correcting the chain configuration.
What to inspect
- The complete certificate chain and the specific chain element whose revocation status could not be determined.
- CRL distribution points, OCSP/AIA retrieval paths, proxy and firewall behavior from the authenticating machine.
- CRL/OCSP freshness, CA publication health, and whether the failure changes after cache-only versus network-enabled validation.
References
- Microsoft: CertGetCertificateChain and revocation checking
- RFC 5280: Internet X.509 PKI certificate and CRL profile
- Microsoft: SSPI status codes
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.