Recently I ran into an issue with Microsoft Certificate Services and Windows Hello for Business. A new parallel Microsoft PKI environment had been built out, and we were testing with new workstation certificates, domain controller certificates and new CA Root and Sub certificates distributed. All was working well.
The issue manifested when people took their corporate hybrid laptops off the network and attempted to log in with their Windows Hello Pin offline. So someone is at home and they can no longer log into their laptop with their Pin, they have to use their password.
After a lot of troubleshooting we focused In on the CRL. In this case the CRL location was set up as an http location only. CRL locations are normally cached by computers. In this case that cache wasn’t working correctly, which could have been how Windows handles the timeout with http locations – I didn’t delve into it too deeply as we needed to resolve the issue quickly. The fix was to add an LDAP CRL location. Once we did that and reissued the CA certificates and domain controller Kerberos certificates everything worked fine offline.