JSC failed due to 'Warning: Potential Security Risk - Failed Revocation Check' even when revocation check is disabled under ca-profile on SRX

JSC failed due to 'Warning: Potential Security Risk - Failed Revocation Check' even when revocation check is disabled under ca-profile on SRX

        ca-profile xxx {
            ca-identity yyy;
            revocation-check {
                disable;  <<------
            }

The 'revocation check disable' configured under ca-profile controls PKI behavior on SRX only. It does not take effect on JSC client as it's an NCP client which has it's own PKI process. As long as the  CRL Distribution Point (CDP) information is available on the local-certificate signed by the root CA, JSC client validates the revocation list.

In order to resolve this issue, you will need to either ensure the  URL in CRL Distribution Point (CDP) of the certificate is reachable and valid for JSC client, or sign a new certificate and remove the CDP information from the new certificate, then apply the new cert for JSC VPN. 

Here are the steps on CA server to exclude CDP information from signed certificates: 
1. Star the specific CA and go to Properties -> Extensions -> Select Extensions -> CRL Distribution Point (CDP)
2. Remove CDP entries from the given list (please keep a backup for future use)
3. Uncheck the folllowing options:
  Include in CRL Distribution Poiny (CDP) extension of issued certifities 
  Include in the AIA extension of issued certificates 
4. Click Apply/OK to effect the changes 
5. Restart CA cervice (right click on CA-> All tasks -> Stop -> Start)
6. Signed the new CSR generated by SRX
7. Check the signed leaf CA to ensure that no CDP information is included on the new certificate 
8. Restore your CA with CDP options if needed
Note: the menu might differ for different CAs, kindly contact your CA administrator for assistance