Details of the event with ID 67 of the source Microsoft-Windows-CertificationAuthority

Author Uwe Gradenegger Posted on Categories Certification Authority, Events Tags Event Viewer, Cert Publishers
Event Source:Microsoft-Windows-CertificationAuthority
Event ID:67 (0x43)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_CRL_PUBLICATION_TOO_MANY_RETRIES
Event text (English):Active Directory Certificate Services made %1 attempts to publish a CRL and will stop publishing attempts until the next CRL is generated.
Event text (German):Es wurden %1 Veröffentlichungsversuche der Zertifikatsperrliste durchgeführt. Die Veröffentlichungsversuche werden bis zur nächsten Zertifikatsperrlisten-Generierung abgebrochen.

Parameter

The parameters contained in the event text are filled with the following fields:

  • %1: NumberOfAttempts (win:UnicodeString)

Description

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

This problem occurs when the certificate revocation list could be successfully generated, but subsequently could not be copied to one of the configured CRL distribution points. Possible causes are:

  • The server on which the CRL distribution point is set up is unreachable.
  • The certification authority does not have permissions to the share or LDAP path that has been set up. By default, the server on which the certification authority is installed is a member of the "Cert Publishers" group. Since the group membership is only applied when the account (in the case of the certification authority: NT-AUTHORITY\SYSTEM) logs on again, the server on which the certification authority is installed must be restarted once after installation.

Security assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If the certification authority is not able to generate or publish a CRL, it is highly likely that it will expire on the distribution points in a short time. In this case, there is a threat of failure of the IT services that depend on the PKI. Therefore, this event must be rated as "critical" in terms of availability.

Microsoft's rating

Microsoft evaluates this event in the Securing Public Key Infrastructure (PKI) whitepaper with a severity score of "Low".

External sources