:/ The suspicion is that my certs are wrong? As opposed to just telling Windows where to find the CRL? Lame...
OK, let's investigate! I was neither good at obscuring my domain heiarchy, nor did it end up mattering if I have to share my certs, so let's give up on that.
At my network edge, my firewall is redirecting all outbound DNS traffic to a DNS Forwarder at my edge network. I'm also pointing
dc.rxrhouse.net to that edge DNS Forwarder directly. That edge DNS Forwarder is blocking lookups to
rxrhouse.net, that way none of the lookups leak to public resolvers and never get my public DNS records. I do own the domain. It's just that IPA whined when it could find my public records without NS delegations. I have no intention of any of this being on the public internet...
dc.rxrhouse.net is the Root CA,
dc.rxrhouse.net's root certificate (Certificate #1 in IPAs Certificate Manager) is attached as dc_rxrhouse_net-root.crt.
Under that, I have a pdc.lin.rxrhouse.net... I installed that as a Subordinate CA, and signed it's CSR with
dc.rxrhouse.net, and installed that cert back to
pdx.lin.rxrhouse.net, and it seems to work fine... I mean, it's running, it isn't giving any errors... I don't know how it is relevant, but that cert is attached as pdc_lin_rxrhouse_net-root.crt
pdc.win.rxrhouse is a Windows Server (With GUI Features) 2022 Active Directory Domain Services server. It has my users and Windows hosts associated with it; Once certs are working, pdc.win.rxrhouse will be Interforest Trusted with
pdc.lin.rxrhouse.net, so Linux hosts have Windows users.
pdc.win.rxrhouse.net seems to work, doesn't give me any grief, but it doesn't have a cert, cuz it gets it's cert from ADCS...
stb.win.rxrhouse.net is where I'm having my problems... It is simply a Windows Server Core 2022 Active Directory Certificate Services server, and I domain joined it, and made the Enterprise Administrator a local Administrator. I installed ADCS by adding the Role, I did the post installation wizard selecting Enterprise, Subordinate CA. I've been through this a bunch of times, and could not get Windows to accept "
win.rxrhouse.net" as the CN as I had used
lin.rxrhkuse.net on pdc.lin.rxrhouse.net... By "Not accept," I mean that Windows WOULD accept it, finish the install, but then when I came back with a signed cert, it would give nondescript errors about "The specified file could not be found." SO, ultimately, I accepted it's default CN, added that default to
dc.rxrhouse.net as a Host Alias so that it would sign the CSR, installed the cert back to Windows, Windows prompted for the root certificate, I provided the one mentioned and attached above, which Windows accepted, but with the warning that the CRL couldn't be found for verification. The certificate server process didn't run, and when I tried running it manually, I got the same warning about not being able to find / verify the CRL. The Windows errors have really proven to be non-descript :/ Google hasn't been a ton of help... Anyway, THAT cert is attached as stb_win_rxrhouse_net-root.crt
Of course, there are more certs in the chain... Should I have given Windows more of them? Should I not have jumped straight to #1, the root? Should I have perhaps given the CA Agent cert first? Is there perhaps a single cert file that has the entire chain in it?
If the error is honest, I just need to tell Windows the location of the CRL... Windows doesn't have a "CRL Distribution Point (CDP)" configured... But even I have my own doubts that it's a relevant data point.