Revoked Certificate Still Trusted? Issue, Revoke, Publish the CRL and Prove the Client Sees It A real AD CS test: issue a certificate, revoke it, publish a new CRL and check from a clean client. Includes the role separation error, the CA that kept saying passed, and an expired OCSP lookup. Oct 19, 2026 11 min read Active Directory
