An error occurred during an attempt to build the certificate chain for the relying party trust certificate '---' identified by thumbprint ‘---’. Possible causes are that the certificate has been revoked, the certificate chain could not be verified as specified by the relying party trust’s encryption certificate revocation settings or certificate is not within its validity period.
Revocation status for a certificate in the chain for CA certificate 0 for --- could not be verified because a server is currently unavailable. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613).
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. --- The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613).
a: Once we found this very well written article it was all clear.
- Boot up the offline root ca
- open an elevated command prompt
- run: certutil -crl
- It will issue a new CRL file here: C:\Windows\System32\CertSvr\CertEnroll\
- Copy that file to 2 places