Windows 10 error when running certutil command

[djpackham]

Description of Issue:

While running the certutil -verify -urlfetch mypiv_auth.cer command to verify the revocation status of my PIV auth certificate, certutil is throwing the error:

Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

• Using the same certificate and running the same certutil command on a Windows 7 workstation works fine.
• PIV login is working for Windows 10, so don't think there is any big issue using Windows 10, but may need to update Playbook to specify Windows 10 may throw this error when running certutil command.

Details of Issue:

Receiving error:

Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

CertUtil: -verify command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

References (Docs, Links, Files):

• Following guidance on https://piv.idmanagement.gov/networkconfig/ports/ for running certutil command

If a New Page or Content is Needed, Expected Outcomes:

Link to the Content Page for Contributors:

[mttcpr2]

You have to enable CAPI2 diagnostic logging to see what is happening. Open the Event Viewer, Applications and Services Logs, Microsoft, Windows, CAPI2. Right click Operational and Enable Log. Stepping through the events and examining the details should reveal the problem.

[bob-fontana]

Neither c:\windows\syswow64\nss\certutil.exe nor c:\windows\system32\nss\certutil.exe exist on my system. I'm running Windows 10 and Firefox R56. I am not sure whether previous versions of Firefox installed a certutil.exe into the nss folder. I'm a contractor and do not have a GSA or Fed Windows installation, so the system I'm using may not match what the Feds have.

[milesgratz]

I stumbled upon this GitHub issue (I'm not familiar with GSA/piv-guides or this repo) while Googling this same CertUtil: -verify command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND) error message. In my case, I was getting this error because I had a duplicate Root CA certificate in the Trusted Root Certification Authorities in Certificates - Local Computer (CERTLM.msc). No error messages in the CAPI2 logs, very bizarre.

[maxwellfunk]

verify that this command is working fine on a windows 10 machine with exported GSA PIV auth certificate. Note that exported format may impact errors seen.

[ryancdickson]

The issue (bug) was corrected by Microsoft in 2019 - more information included in https://support.microsoft.com/en-us/topic/june-18-2019-kb4503294-os-build-14393-3053-abcd70b9-7271-b243-c41d-a00295976bde