“44 - Different CRL scope” error when setting up an intermediate certificate authority

You set up an intermediate certificate authority (CA). It fails with a 44 - Different CRL scope error.

Version and installation information

PE version: All supported

Solution

The rules that any CA must follow are the same. Either:

• Every paired CA and CRL in the external CA chain must have a CRL distribution points extension on the CA side that matches an Issuing distribution points extension on the CRL side.

• Or both must omit those extensions.

If one of the two uses an extension and the other one doesn’t, you get a 44 - Different CRL scope error.

Read a blog post from the BBC about finding and fixing the error for more information.

The steps you need to take to fix this issue vary based on the third-party CA software that you use. Please get in touch with your CA vendor support. Our team can’t provide support for third-party software, but we can try to help you understand why your CA isn’t working with our software.