Revoked certificate shows as valid in the certificate viewer

Question

Hi Microsoft Team,

We have a certificate revoked by CA but when I open the certificate in windows, the certificate viewer still show: "This certificate is OK."
I have used openssl and other tools to check revocation status, result is Certificate has revoked!
Can you help me why the certificate viewer still show: "This certificate is OK."?
When the certificate viewer check revocation status?
I have found a article, in the article has a certificate has revoked and the certificate viewer is showing: "This certificate was revoked by its certification authority" https://github.com/bitcoin/bitcoin/issues/21725

Answer 1

Hi there,

This is a normal behavior.

Double click certificates and check in Certificate Path tab, this process just check the AIA path to get the CA certificates until the certification path terminates at a trusted, self-signed certificate. this process does not check the revocation information of the certificate and thus will not show if the certificate is revoked under “Certificate Status”.

More Information, please refer to the article as below:
http://technet.microsoft.com/en-us/library/cc753833.aspx

We need to use certutil -verify -urlfetch <Cert_name.cer> to check the real status. And according to the Certutil output we can find the cert has been revoked.

---------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

Hi, I did encounter the same issue, the certificate was revoked by the CA and even the certutil commands shows the status as revoked, however when I checked the site consuming this cert it showed no error. Can anyone suggest what is the actual reason for this issue? Thanks