An error occurred during an attempt to build the certificate chain for the relying party trust certificate %cert% identified by thumbprint %thumbprint%. Possible causes are that the certificate has been revoked, the certificate chain could not be verified as specified by the relying party trust’s encryption certificate revocation settings or certificate is not within its validity period.
Revocation status for a certificate in the chain for CA certificate 0 for %server% could not be verified because a server is currently unavailable. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613).
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613).
a: Once we found this very well written article it was all clear.
Boot up the offline root ca
open an elevated command prompt
run: certutil -crl
It will issue a new CRL file here: C:\Windows\System32\CertSvr\CertEnroll\
Copy that file to 2 places
\\%appserverhostingyourpkiwebsite%\CertEnroll
\\%issuingCAServer%\c$\Windows\System32\certsrv\CertEnroll
Then we were able to start the 'Active Directory Certificate Services' service on the Issuing CA server and all the certificates issued by that CA were valid again.
