Okta Advanced Server Access Passwordless Login Denies Access With Smart Card Certificate Revocation Error

An Okta Advanced Server Access (ASA) passwordless login denial occurs when the Domain Controller lacks access to the Certification Revocation List (CRL) Distribution Point. Configuring the network to allow the Domain Controller to reach the required URL resolves the issue. When attempting a Remote Desktop Protocol (RDP) connection to an Active Directory (AD)-joined ASA server using a passwordless login, Okta denies the login attempt and generates an error message.

The revocation status of the smart card certificate used for authentication could not be determined.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Advanced Server Access (ASA)
• Active Directory (AD)-joined passwordless login

Okta Advanced Server Access uses a smart card login process for the AD-joined passwordless feature. Windows smart card logins require the authenticating Domain Controller to reach the CRL Distribution Point (CDP) location. Okta sets the CDP on the passwordless login certificates to the app.scaleft.com URL. The Domain Controller generates an error when it lacks internet access to the app.scaleft.com URL.

How is the smart card certificate revocation error resolved?

Update the network configuration to allow the Domain Controllers to reach the required URL over the internet by completing this action:

• Configure the network routing or firewall rules to allow the Domain Controllers to reach the app.scaleft.com URL over the internet.