I just noticed that I was not able to connect because there was na expired CRL in my CA chain. After some investigation, it turns out the ACS server can't get the CRL information from the CA server. It was working at one time. Does anyone know what permissions need to be changed to get it to work? I know I can change ACS to ignore CRL erorrs, but then what would be the point of using CRLs at all? I'm assuming something broke when I was trying to get web enrollment to work by playing with the settings on the CA server. Here is the error from the ACS server:
Message_Code = 33402
Message_Severity = ERROR
Category = CSCOacs_Internal_Operations_Diagnostics
Diagnostic_Info = LastErrorMessage=Failed performing HTTP GET error: 403, Certificate Revocation list Url=http://CAServer/CertEnroll/CA.crl
