Disabling the SMTP Exit Module of a Certification Authority

Author Uwe Gradenegger Posted on Categories Troubleshooting Tags Exit module

Assume the following scenario:

  • The certification authority is configured to use the SMTP exit module to send e-mail notifications about the events on the certification authority.
  • The configured SMTP server is unreachable, for example due to a failure.

In this case, the exit module cannot deliver the email notifications. It will time out and the certification authority will work very slowly.

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

In the Windows Event Viewer, event no. 46 is logged.

The "Windows default" Exit Module "Initialize" method returned an error. The transport failed to connect to the server. The returned status code is 0x80040213 (-2147220973). The Certification Authority was unable to send an email notification for EXITEVENT_STARTUP to admins1@fabrikam.com,admin2@fabrikam.com.

In such a case, it makes sense to disable the SMTP exit module.

This can be done by unsubscribing from all events.

Which events trigger an e-mail notification is defined in the following registry value.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{Name-der-Zertifizierungsstelle}\ExitModules\CertificateAuthority_MicrosoftDefault.Exit\smtp\EventFilter

If the value is set to "0", all events are unsubscribed.

The following command line command can also be used to unsubscribe from all events.

certutil -setreg exit\smtp\eventfilter 0

For the changes to take effect, the certification authority service must be restarted.

Alternative: Disable exit module completely

It is also possible to completely disable the exit module. See the article "Operating the certification authority without an exit module ".