Details of the event with ID 48 of the source Microsoft-Windows-CertificationAuthority
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 48 (0x30) |
| Event log: | Application |
| Event type: | Warning |
| Symbolic Name: | MSG_E_CA_CERT_REVOCATION_OFFLINE |
| Event text (English): | Revocation status for a certificate in the chain for CA certificate %3 for %1 could not be verified because a server is currently unavailable. %2. |
| Event text (German): | Der Sperrstatus eines Zertifikats in der Kette des Zertifizierungsstellenzertifikats %3 für %1 konnte nicht verifiziert werden, da der Server momentan nicht verfügbar ist. %2. |
Parameter
The parameters contained in the event text are filled with the following fields:
- %1: CACommonName (win:UnicodeString)
- %2: ErrorCode (win:UnicodeString)
- %3: CACertIdentifier (win:UnicodeString)
Example events
Revocation status for a certificate in the chain for CA certificate 2 for ADCS Labor Issuing CA 3 could not be verified because a server is currently unavailable. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE).
Description
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
The event occurs when the revocation status for one of the previous (not the current) certification authority certificates cannot be checked. This can have the following causes:
- The CRL in question has expired, see the article "What impact does the expiry of the CRL of one of the higher-level certification authorities have on the certification authority? "
- The CRL in question cannot be downloaded, see the article "What impact does incorrect revocation information of a certification authority certificate have on the certification authority? "
It should be noted that CAPI returns the same error code CRYPT_E_REVOCATION_OFFLINE for an expired CRL and for an unreachable CRL.
The certification authority service will start normally.
If the current certification authority certificate is affected, then the event with ID 100 is generated and the certification authority service does not start. See the article "The certification authority service does not start and throws the error message "The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)" ".
Security assessment
The security assessment is based on the three dimensions of confidentiality, integrity and availability.
Since this event only occurs when the current certification authority certificate is not affected, there should be no impact on availability.
Microsoft's rating
Microsoft evaluates this event in the Securing Public Key Infrastructure (PKI) Whitepaper with a severity score of "Low".
Related links:
- Overview of Windows events generated by the certification authority
- Overview of audit events generated by the certification authority