Details of the event with ID 67 of the source Microsoft-Windows-CertificationAuthority

Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	67 (0x43)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_CRL_PUBLICATION_TOO_MANY_RETRIES
Event text (English):	Active Directory Certificate Services made %1 attempts to publish a CRL and will stop publishing attempts until the next CRL is generated.
Event text (German):	%1 certificate revocation list publication attempts were made. The publication attempts are canceled until the next certificate revocation list generation.

Parameter

The parameters contained in the event text are filled with the following fields:

• %1: NumberOfAttempts (win:UnicodeString)

Description

This problem occurs when the certificate revocation list could be successfully generated, but subsequently could not be copied to one of the configured revocation list distribution points. Causes for this can be:

• The server on which the revocation list distribution point is set up is unreachable.
• The certification authority does not have permissions to the share or LDAP path that has been set up. By default, the server on which the certification authority is installed is a member of the "Cert Publishers" group. Since the group membership is applied only when the account (in the case of the certification authority: NT-AUTHORITY\SYSTEM) is newly logged in, the server on which the certification authority is installed must be restarted once after the installation.

Safety assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If the certification authority is not able to generate or publish a revocation list, it is highly likely that it will expire on the distribution points in a short time. In this case, there is a threat of failure of the IT services that depend on the PKI. Therefore, this event must be rated as "critical" in terms of availability.

Microsoft rating

Microsoft evaluates this event in the Securing Public Key Infrastructure (PKI) Whitepaper with a severity score of "Low".

Related links:

• Overview of Windows events generated by the certification authority
• Overview of audit events generated by the Certification Authority

External sources

• Event ID 67 - AD CS Certificate Revocation List (CRL) Publishing (Microsoft)
• Securing Public Key Infrastructure (PKI) (Microsoft)