This message was deleted.

Sounds like the domain controller cant check the crl. Look at the ad containers for the crl and see if the path is valid.

your timeout for the offline CA is probably too low, I’ve run into that a few times

Thank you @Rob Zylowski and @Mike Streetz (O_P) for your inputs

Thank you Mike. Will go through it

Definitely check if the CRL can be pulled. Or even if the CRL file on the CA that issues the certs in the file system is expired. If so, and multitier pki, check your root CA if a new CRL was minted there and needs to be copied to your issuing CA (if multitier)

Sure. Thank you Jon