Übersicht über die vom Onlineresponder (OCSP) generierten Windows-Ereignisse

Nachfolgend eine Übersicht über die vom Onlineresponder (OCSP) erzeugten Ereignisse in der Windows-Ereignisanzeige.

Die Ereignisse des Onlineresponders sind nicht offiziell dokumentiert. Die nachfolgende Liste wurde mit Hilfe des Tools Windows Event Log Messages (WELM) erzeugt.

Der Online Responder (Online Certificate Status Protocol, OCSP) ist eine alternative Möglichkeit, Sperrstatusinformationen für Zertifikate bereitzustellen. Entitäten, die den Sperrstatus eines Zertifikats überprüfen möchten, müssen dank OCSP nicht die komplette Liste aller widerrufenen Zertifikate herunterladen, sondern können gezielt eine Anfrage für das betreffende Zertifikat an den Online Responder stellen. Für eine detailliertere Beschreibung siehe Artikel "Grundlagen Online Responder (Online Certificate Status Protocol, OCSP)".

Ereignisquellen

Die Ereignisse des Onlineresponders werden in das Anwendungs-Protokoll geschrieben. Folgende Quellen enthalten OCSP-Ereignisse:

  • OnlineResponder
  • OnlineResponderRevocationProvider (Microsoft-Windows-OnlineResponderRevocationProvider)
  • OnlineResponderWebProxy

Vordefinierte Ansicht in der Windows-Ereignisanzeige

Eine entsprechend gefilterte Ansicht ist in der Kategorie "Active Directory Certificate Services" auf jedem System, auf dem der Onlineresponder installiert ist, bereits vorkonfiguriert.

Ereignisquelle Microsoft-Windows-OnlineResponder

IDTypEreignistext
17InformationOnline Responder Service was started.
18InformationOnline Responder Service was stopped.
20FehlerThe Online Responder Service did not start: %1.
21Fehler%1: The Online Responder Service detected an exception at address %2. Flags = %3. The exception is %4.
22FehlerOCSP Responder Services did not process an extremely long request from %1. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. Unless exhaustive logging is enabled, this error will only be logged every 20 minutes.
23FehlerThe Online Responder Service could not locate a signing certificate for configuration %1.(%2)
24InformationThe Online Responder Service successfully (re)loaded a signing certificate for configuration %1.
25WarnungThe signing certificate for Online Responder configuration %1 will expire soon.
26FehlerThe signing certificate for Online Responder configuration %1 has expired. OCSP requests for this configuration will be rejected.
27WarnungThe signing certificate for Online Responder configuration %1 was not updated.(%2)
28InformationThe signing certificate for Online Responder configuration %1 has been renewed. The hash for the new certificate can be located in additional data.
29FehlerSettings for Online Responder configuration %1 cannot be loaded. OCSP requests for this configuration will be rejected.(%2)
31WarnungPerformance counters for the Online Responder Service cannot be initialized.
32InformationThe Online Responder Service detected a change in the signing certificate template version for configuration %1. The old version was (%2,%3), the new version is (%4,%5).
33FehlerThe Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3)
34FehlerThe Online Responder Service encountered an error while submitting the enrollment request for configuration %1 to certification authority %2. The request ID is %3.(%4)
35FehlerThe Online Responder Service failed to install the enrollment response for configuration %1 for the signing certificate template %2 . The request ID is %3.(%4)
36 InformationThe Online Responder Service successfully enrolled for a new signing certificate for configuration %1. The new certificate’s hash can be located in additional data.
37WarnungThe signing certificate for Online Responder configuration %1 does not include the mandatory OCSP No Revocation Checking extension. You must configure an OCSP Response Signing certificate template to include this extension in all OCSP Response Signing certificates. For more information, see Configure a CA to Support OCSP Responders in the Online Responder console Help.

Ereignisquelle Microsoft-Windows-OnlineResponderRevocationProvider

IDTypEreignistext
16WarnungFor configuration %1, Online Responder revocation provider failed to update the CRL Information: %2.
17FehlerFor configuration %1, Online Responder revocation provider either has no CRL information or has stale CRL information.
18FehlerFor configuration %1, Online Responder revocation provider found a delta CRL referring to a newer Base CRL.

Ereignisquelle Microsoft-Windows-OnlineResponderWebProxy

IDTypEreignistext
17FehlerThe Online Responder web proxy failed to Initialize. %1
18InformationThe Online Responder web proxy is successfully loaded.
19InformationThe Online Responder web proxy is unloaded.
20InformationThe Online Responder web proxy detected an invalid configuration for the %1 property. The value was changed from %2 to %3.
21FehlerThe Online Responder web proxy did not process an extremely long request from %1. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. This error will only be logged every 20 minutes.

Weiterführende Links:

Externe Quellen

Ein Gedanke zu „Übersicht über die vom Onlineresponder (OCSP) generierten Windows-Ereignisse“

Kommentare sind geschlossen.

de_DEDeutsch