For some automated tests on my project, I need to revoke a certificate which has been generated locally by makecert.exe.
First, I generate a signer certificate and associated CRL using the following commands, and use certutil
to install them to my machine
# Generate Signer Cert
makecert.exe -pe -n CN=SignerCert -r -sr LocalMachine -ss Root -a sha256 `
SignerCert.cer -cy authority
certutil -installcert SignerCert.cer
# Set up a certificate revocation list for the CA cert above
makecert.exe -crl -n CN=SignerCert -r -sr LocalMachine SignerCert.crl
certutil -addstore Root SignerCert.crl
I then generate another cert for authentication, the one I would eventually like to revoke
makecert.exe -pe -n CN=AuthCert `
-ir LocalMachine -is Root -ic SignerCert.cer `
-sr LocalMachine -ss My -a sha256 AuthCert.cer
and install it as follows (via some powershell)
$x509cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$certPath = Join-Path $pwd AuthCert.cer
$x509cert.Import("$($certPath)")
Set-Location "Cert:\LocalMachine\My"
$cert = Get-ChildItem | Where-Object { $_.Thumbprint -eq $x509cert.Thumbprint}
$cert = $cert[0]
$cert.FriendlyName = $FriendlyName
So far so good. If I pull up certlm
on my machine, I can see both SignerCert and AuthCert under "Personal > Certificates", SignerCert under "Trusted Root Certification Authorities > Certificates", and SignerCert under "Trusted Root Certification Authorities > Certificate Revocation Lists".
Now for the problematic operation. I would like to revoke AuthCert: certutil
has a -revoke
operation which I could use, so let's say I retrieve AuthCert's serial number and run the following command
> certutil -revoke 12345678
Revoking 12345678 -- Reason: Unspecified
ICertAdmin::RevokeCertificate: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
CertUtil: -revoke command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
CertUtil: The RPC server is unavailable.
The RPC's probably unavailable because there's no local CA
> certutil -cainfo
CertUtil: No local Certification Authority; use -config option
CertUtil: No more data is available.
Can someone offer me a rundown on what's going on here and pointers as to how I can successfully revoke the cert?