Event ID 100 from Microsoft-Windows-CertificationAuthority reports that Active Directory
Certificate Services did not start because it could not load or verify the CA's own
certificate. When the inner error is CRYPT_E_REVOCATION_OFFLINE (0x80092013), the issuing
CA cannot validate its chain because the parent (usually offline root) CA's CRL has expired
or is unreachable. The whole issuing CA is down until revocation data is fixed.
Event ID 100
AD CS Event 100: CA service fails to start (revocation offline)
What it means
Common causes
The offline root CA's CRL expired — the annual boot-and-publish ritual was missed.
A fresh root CRL exists but was never copied to the HTTP CDP location the issuing CA checks.
The CDP host was decommissioned during a migration while the issuing CA's chain still points at it.
How to fix it
Power on the offline root CA, publish a new CRL (
certutil -crl), and copy it to every CDP location referenced in the issuing CA's certificate; then start CertSvc.Verify with
certutil -verify -urlfetchagainst the issuing CA's own certificate that all CDP fetches now succeed.As a temporary emergency measure only, you can start the CA while ignoring offline revocation:
certutil -setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE, restart CertSvc, and remove the flag (-setreg ca\CRLFlags -CRLF_REVCHECK_IGNORE_OFFLINE) once the CRL is fixed.Put root CRL publication in the calendar with a reminder well before Next Update — or set a long CRL validity on the root appropriate to your rotation schedule.