Certificate CRL issue

The immediate fix is to make every CRL Distribution Point embedded in the TrueSSO certificate chain reachable with a current CRL from both the Horizon desktop/agent and the authenticating domain controllers.

Certificate issuance succeeding and Enterprise PKI showing no errors do not prove that those systems can retrieve the CRL. In TrueSSO, this error occurs when the CRL server is unavailable or the domain controllers cannot determine revocation status.[^1^](https://kb.omnissa.com/s/article/89994?lang=en_US&queryTerm=trues+revocation+status "TrueSSO - Public Key Infrastructure - CRL : Error: "The attempted logon ...")

Test the exact certificate and CRL paths

1. Export one failing TrueSSO user certificate as a DER-encoded .cer file.
2. Copy it to:
   • The affected Horizon desktop or agent machine.
   • A domain controller handling the authentication.
3. On each system, run from an elevated command prompt:

certutil -verify -urlfetch "C:\Temp\TrueSSO-user.cer"

This performs chain validation and attempts to retrieve the CRLs referenced by the certificate’s Authority Information Access (AIA) and CRL Distribution Point (CDP) extensions.^2^

Review the output for:

• Failed to retrieve
• DNS or connection errors
• HTTP errors
• An expired CRL
• A missing base or delta CRL
• A CDP that resolves only from the CA server
• A failure involving an intermediate CA certificate rather than the user certificate

Repeat this for every certificate in the chain except the root CA. Windows smart-card authentication requires each non-root CA certificate to contain a valid CDP, and revocation validation must succeed from both the client and the domain controller.^3^

Correct the failing CDP

Open the failing certificate, select Details → CRL Distribution Points, and test the exact HTTP, LDAP, or file location shown there from both systems.

Depending on the result:

• CRL expired or missing: On the issuing CA, open Certification Authority → Revoked Certificates → Action → All Tasks → Publish, then publish the applicable CRL. Alternatively:

certutil -config "CAHOST\Issuing CA Name" -CRL

Publishing creates new CRL data according to the CA configuration, but it does not prove that the CRL was copied to the HTTP or other retrieval endpoint. Verify the endpoint separately.^4^

• HTTP CDP unreachable: Correct DNS, routing, firewall, proxy, web-server availability, anonymous read access, or the .crl MIME mapping. Horizon documentation specifically identifies firewalls, proxies, network controls, and stale CRLs as causes of revocation-check failures.^5^
• LDAP CDP unreachable: Check AD connectivity, replication, and whether the CRL was actually published to the LDAP location.
• Delta CRL fails: Ensure both the current base CRL and its associated delta CRL are published and retrievable. A delta CRL does not replace its base CRL.^4^

After correcting publication or connectivity, rerun certutil -verify -urlfetch from both the desktop and DC. The expected result is successful retrieval and verification of all required CRLs.

If the certificate contains the wrong CDP

Changing the CA’s CDP configuration affects only certificates issued afterward. Existing TrueSSO certificates retain their original CDP URLs.^4^

Therefore:

1. Add and validate a reachable CDP on the issuing CA.
2. Publish current CRLs to that endpoint.
3. Issue a nonproduction TrueSSO certificate and verify that its CRL Distribution Points extension contains the corrected URL.
4. Validate it from the Horizon desktop network and the DC network.
5. Reissue the affected TrueSSO certificates.
6. Keep the old CDP operational until no unexpired certificate references it.

Do not disable revocation checking as the production workaround. Windows treats an unavailable, invalid, expired, revoked, or unknown CRL status as a revocation failure during smart-card authentication.^3^

References

1. TrueSSO - Public Key Infrastructure - CRL : Error: "The attempted logon ...
2. Diagnostic logging for troubleshooting Workplace Join issues
3. Guidelines for enabling smart card logon with third-party certification authorities
4. Operate certificate revocation, CRL publication, and CDP changes in AD CS
5. Troubleshooting Smart Card Certificate Revocation Checking