Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority

Author Uwe GradeneggerPosted on Categories Active Directory, Events, Certification AuthorityTags , , , ,
Event Source:Microsoft-Windows-CertificationAuthority
Event ID:74 (0x4A)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_BASE_CRL_PUBLICATION_HOST_NAME
Event text (English):Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):Failed to publish a base certificate revocation list for key %1 at the following location on server "%4": %2. %3.%5%6

Parameter

The parameters contained in the event text are filled with the following fields:

  • %1: CAKeyIdentifier (win:UnicodeString)
  • %2: URL (win:UnicodeString)
  • %3: ErrorMessageText (win:UnicodeString)
  • %4: HostName (win:UnicodeString)
  • %5: param5 (win:UnicodeString)
  • %6: AdditionalErrorMessage (win:UnicodeString)

Example events

Active Directory Certificate Services could not publish a Base CRL for key 5 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 2(5),CN=ADCS Labor Issuing CA 2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de.  Directory object not found. 0x8007208d (WIN32: 8333 ERROR_DS_OBJ_NOT_FOUND).
 ldap: 0x20: LDAP_NO_SUCH_OBJECT: 0000208D: NameErr: DSID-03100288, problem 2001 (NO_OBJECT), data 0, best match of:
 	'CN=ADCS Labor Issuing CA 2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de'
Active Directory Certificate Services could not publish a Base CRL for key 0 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 1,CN=ADCS Labor Issuing CA 1,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de. Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS).
ldap: 0x32: LDAP_INSUFFICIENT_RIGHTS: 00002098: SecErr: DSID-03150F94, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
Active Directory Certificate Services could not publish a Base CRL for key 1 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 1(1),CN=CA02,CN=cdp.CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=en.  The object name has bad syntax. 0x8007208f (WIN32: 8335 ERROR_DS_BAD_NAME_SYNTAX).
ldap: 0x22: LDAP_INVALID_DN_SYNTAX: 0000208F: NameErr: DSID-03100232, problem 2006 (BAD_NAME), data 8349, best match of:
	'CN=ADCS Labor Issuing CA 1(1),CN=CA02,CN=cdp.CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=en'
Active Directory Certificate Services could not publish a Base CRL for key 1 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 1(1),CN=CA02,CN=cdp,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de..  A referral was returned from the server. 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL).
ldap: 0xa: LDAP_REFERRAL: 0000202B: RefErr: DSID-0310084A, data 0, 1 access points
	ref 1: 'intra.adcslabor.de.'
Active Directory Certificate Services could not publish a Base CRL for key 0 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 1,CN=ADCS Labor Issuing CA 1,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=en. 
The Directory Service encountered an unknown failure. 0x800720ef (WIN32: 8431 ERROR_DS_UNKNOWN_ERROR).
ldap: 0x1: LDAP_OPERATIONS_ERROR: 000020EF: SvcErr: DSID-0203058D, Problem 5012 (DIR_ERROR), data -1414

Description

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

This event occurs if the certificate revocation list was successfully generated but could not be copied to one of the configured revocation list distribution points. It usually occurs together with the events 65, 66 and 75 on.

This may be due to

Error code ERROR_DS_OBJ_NOT_FOUND

The LDAP object does not exist. If it does exist, for example after changing the configuration of the LDAP blacklist paths, the LDAP object can be created with the following command:

certufil -f -dspublish {filename-of-CRL}

However, the prerequisite for this is,

  • that the executing user has appropriate rights in the Active Directory.
  • that the "Include in CRLs" option is activated for the LDAP revocation list distribution point so that the LDAP path is written to the certificate revocation list (extension "Published CRL Locations").

Error code ERROR_DS_INSUFF_ACCESS_RIGHTS

See article "Publishing a certificate revocation list (CRL) fails with the error message "Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)".„.

Error code ERROR_DS_OBJ_NOT_FOUND

See article "Publishing a certificate revocation list (CRL) fails with the error message "Directory object not found. 0x8007208d (WIN32: 8333 ERROR_DS_OBJ_NOT_FOUND)".„.

Error code ERROR_DS_BAD_NAME_SYNTAX

The configured LDAP blacklist publishing point contains invalid characters.

Error code ERROR_DS_UNKNOWN_ERROR

This error can occur if the directory service is faulty. A Offline defragmentation of the directory service database.

Error code ERROR_DS_REFERRAL

Can occur if the configured LDAP blacklist distribution point does not point to the root domain of the Active Directory forest. May also occur if invalid characters are entered at the end of the configured LDAP blacklist distribution point.

The default value is generic and should work for all environments.

ldap:///CN=%7%8,CN=%2,CN=cdp,CN=Public Key Services,CN=Services,%6%10

Safety assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If the certification authority is not able to generate or publish a revocation list, it is highly likely that it will expire on the distribution points in a short time. In this case, there is a threat of failure of the IT services that depend on the PKI. Therefore, this event must be rated as "critical" in terms of availability.

Microsoft rating

Microsoft evaluates this event in the Securing Public Key Infrastructure (PKI) Whitepaper with a severity score of "Low".

Related links:

External sources

en_USEnglish
de_DEDeutsch en_USEnglish