Category: Certification Authority

Change the order of the Relative Distinguished Names (RDNs) in the Subject Distinguished Name (DN) of issued certificates

Microsoft Active Directory Certificate Services does not transfer subjects from certificate requests for templates in which the enrollee is allowed to supply them 1:1 into the issued certificate.

Instead, it is defined both which Relative Distinguished Names (RDNs) are allowed and in which order they are written to issued certificates. However, this order can be changed. How this is done is explained below.

Continue reading "Change the order of the Relative Distinguished Names (RDNs) in the Subject Distinguished Name (DN) of issued certificates"

Issuing certificates or CRLs fails with error code CERTSRV_E_NO_DB_SESSIONS

Assume the following scenario:

  • The certification authority cannot issue certificates and/or
  • The certification authority cannot issue certificate revocation lists (CRLs).
  • At least one of the following error messages is logged:

Event ID: 53 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services denied request 12345 because An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions. 0x8009400f (-2146877425 CERTSRV_E_NO_DB_SESSIONS). The request was for CN=Rudi Ratlos. Additional information: Denied by Policy Module

Event ID: 130 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services could not create a certificate revocation list. An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions 0x8009400f (-2146877425). This may cause applications that need to check the revocation status of certificates issued by this CA to fail. You can recreate the certificate revocation list manually by running the following command: "certutil -CRL". If the problem persists, restart Certificate Services.

Continue reading "Issuing certificates or CRLs fails with error code CERTSRV_E_NO_DB_SESSIONS"

Installation of a certification authority fails with error code ERROR_INVALID_PARAMETER

Assume the following scenario:

  • A certification authority is installed
  • The role configuration fails with the following error message:
CCertSrvSetupProperty: The parameter is incorrect. 0x80070057 (WIN32: ERROR_INVALID_PARAMETER).

Continue reading "Installation of a certification authority fails with error code ERROR_INVALID_PARAMETER"

Installation of a certification authority fails with error code "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA)."

Assume the following scenario:

  • An attempt is made to install a certification authority
  • The role configuration fails with the following error message:
An error occurred when creating the new key container "ADCS Labor Issuing CA 3". Please make sure the CSP is installed correctly or select another CSP.
Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).

Continue reading "Installation of a certification authority fails with error code "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).""

Installation of a certification authority integrated into Active Directory using Windows PowerShell fails with error message "A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)"

Assume the following scenario:

  • A certification authority (Enterprise CA) integrated into Active Directory is installed using Windows PowerShell (Install-AdcsCertificationAuthority).
  • The role configuration fails with the following error message:
Install-AdcsCertificationAuthority : Active Directory Certificate Services setup failed with the following error: A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)

Continue reading "Installation of a certification authority integrated into Active Directory using Windows PowerShell fails with error message "A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)""

The certification authority service does not start and throws the error message "The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)"

Assume the following scenario:

  • A certification authority is implemented in the network.
  • The certification authority service does not start.
  • When trying to start the certification authority service, you get the following error message:
The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)

Continue reading "The certification authority service does not start and throws the error message "The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)""

Details of the event with ID 5127 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5127 (0x1407)
Event log:Security
Event type:Information
Event text (English):The OCSP Revocation Provider successfully updated the revocation information. CA Configuration ID: %1 Base CRL Number: %2 Base CRL This Update: %3 Base CRL Hash: %4 Delta CRL Number: %5 Delta CRL Indicator: %6 Delta CRL This Update: %7 Delta CRL Hash: %8
Event text (German):Der OCSP-Antwortdienst hat die Sperrungsinformationen erfolgreich aktualisiert. Konfigurations-ID der Zertifizierungsstelle: %1 Basissperrlistennummer: %2 Basissperrliste, diese Aktualisierung: %3 Basissperrlistenhash: %4 Deltasperrlistennummer: %5 Deltasperrlistenanzeige: %6 Deltasperrliste, diese Aktualisierung: %7 Deltasperrlistenhash: %8

Continue reading "Details of the event with ID 5127 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 5126 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5126 (0x1406)
Event log:Security
Event type:Information
Event text (English):Signing Certificate was automatically updated by the OCSP Responder Service. CA Configuration ID: %1 New Signing Certificate Hash: %2
Event text (German):Das Signaturzertifikat wurde automatisch vom OCSP-Antwortdienst aktualisiert. Konfigurations-ID der Zertifizierungsstelle: %1 Neuer Signaturzertifikathash: %2

Continue reading "Details of the event with ID 5126 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 5125 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5125 (0x1405)
Event log:Security
Event type:Information
Event text (English):A request was submitted to OCSP Responder Service.
Event text (German):An den OCSP-Antwortdienst wird eine Anforderung übermittelt.

Continue reading "Details of the event with ID 5125 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 5124 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5124 (0x1404)
Event log:Security
Event type:Information
Event text (English):A security setting was updated on OCSP Responder Service. New Value: %1
Event text (German):Für den OCSP-Antwortdienst wurde eine Sicherheitseinstellung aktualisiert. Neuer Wert: %1

Continue reading "Details of the event with ID 5124 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 5123 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5123 (0x1403)
Event log:Security
Event type:Information
Event text (English):A configuration entry changed in the OCSP Responder Service. Property Name: %1 New Value: %2
Event text (German):Im OCSP-Antwortdienst wurde ein Konfigurationseintrag geändert. Eigenschaftenname: %1 Neuer Wert: %2

Continue reading "Details of the event with ID 5123 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 5122 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:5122 (0x1402)
Event log:Security
Event type:Information
Event text (English):A Configuration entry changed in the OCSP Responder Service. CA Configuration ID: %1 New Value: %2
Event text (German):Im OCSP-Antwortdienst wurde ein Konfigurationseintrag geändert. Konfigurations-ID der Zertifizierungsstelle: %1 Neuer Wert: %2

Continue reading "Details of the event with ID 5122 of the source Microsoft-Windows-Security-Auditing"