Certutil CRL test - ASN1 bad tag error?

[Andy Hutchins]

All,

I am testing a Windows Server 2003 PKI environment (2 offlines & 1 Online
Issuing Enterprise CA), and whilst verifying CRLs using the command,
certutil -verify 'crlname.crl', I get an error message returned;

Loadcert(Cert) returned ASN1 bad tag value met 0x8009310b.

If I test certificates using the same process they check out OK and my PKI
seems to be operating correctly (Including certificate revocation), without
any problems. I can find no reference as to the likely cause or severity of
this error message, can anybody shed any light on what may cause such an
issue and should I be concerned?

thanks in advance..

Andy

[Vishal Agarwal[MSFT]]

Along with the CRL file, you need to give the CACertificate file too,
otherwise certutil assumes that the given file is a certificate file.

>certutil -verify -?
Usage:
CertUtil [Options] -verify CertFile [ApplicationPolicyList | -
[IssuancePolicyList]]
CertUtil [Options] -verify CertFile [CACertFile [CrossedCACertFile]]
CertUtil [Options] -verify CRLFile CACertFile [IssuedCertFile]
CertUtil [Options] -verify CRLFile CACertFile [DeltaCRLFile]

Thanks,
Vishal Agarwal[MSFT]

--
This posting is provided "AS IS" with no warranties, and confers no rights
"Andy Hutchins" <andyhu...@hotmail.com> wrote in message
news:%232GaV8J...@TK2MSFTNGP10.phx.gbl...