You cannot use a certificate-based logon method to authenticate requests on a computer that is running Windows Server 2008 R2

Symptoms

On a computer that is running Windows Server 2008 R2, you use a certificate-based logon method to authenticate requests for access to one or more of the following kinds of service:

• Wireless authentication

• Virtual private network (VPN)

• Smart Card-based authentication

In this situation, you cannot authenticate the requests. However, you may successfully authenticate the requests after one or more retries.

Notes This issue occurs when you have an Online Certificate Status Protocol (OCSP) URL in the OCSP extension on the server-side certificate.

You may experience the following two issues:

• Event ID 29 may be logged in the System log on a domain controller. This event indicates that the currently-selected domain controller certificate is invalid and therefore blocks smart card logon. However, you may experience this issue without this event being logged.

• A middle tier server accepts certificate based authentication and then needs to acquire a handle to the incoming credentials for impersonation. The likely scenarios for this are, but are not limited to:

  • Internet Information Server (IIS) server

  • VPN server

  • Data Access Server (DAS) server

  • NPS server

  
  
  Example event 29:

• Log Name: System
  Source: Microsoft-Windows-Kerberos-Key-Distribution-Center
  Event ID: 29
  Task Category: None
  Level: Warning
  Keywords: Classic
  Description:
  The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.

Cause

This issue occurs because the locally cached Certificate Revocation List (CRL) is expired and the OSCP responder is offline.

Resolution

To resolve this issue, install the following hotfix on the affected middle tier server or on the domain controller.

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

The frequency of this issue depends on the availability of the OCSP server. This issue occurs when the following conditions are true:

• A response from an OCSP URL is not received when a certificate-based logon attempt is verified.

• None of the locally cached revocation data is time valid.

By default, Windows tries to cache and prefetch CRL certificates in advance. Sometimes, this behavior is skipped. This depends on the CRL lifetime and the presence of a NextPublish Extension. When a certificate is verified, the OCSP URL is checked first. If this verification attempt fails, Windows behaves as if it has recently tried to retrieve a CRL from a CDP point. Therefore, successive verification attempts to connect to a CRL point fail.

After you install the following hotfix, the attempt to retrieve a CRL after a failed OCSP retrieval is successful.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates