Overview of Windows events generated by the certification authority

The following is an overview of the events generated by the certification authority in the Windows Event Viewer.

Event Sources

CA events are written to the application log. The following sources contain CA events:

• Microsoft-Windows-CertificationAuthority

Predefined view in the Windows Event Viewer

An appropriately filtered view is preconfigured in the Active Directory Certificate Services category on each system where the certification authority is installed.

Event source Microsoft-Windows-CertificationAuthority

Some of these events are logged only when the Logging level has been set to 4 (CERTLOG_VERBOSE) or higher for the event log of the relevant certification authority.

ID	Type	Event text
5	Error	Active Directory Certificate Services could not find required registry information. The Active Directory Certificate Services may need to be reinstalled.
6	Information	Active Directory Certificate Services issued a certificate for request %1 for %2.
7	Warning	Active Directory Certificate Services denied request %1 because %2. The request was for %3.
8	Information	Active Directory Certificate Services left request %1 pending in the queue for %2.
9	Error	The Active Directory Certificate Services did not start: Unable to load an external policy module.
10	Warning	Active Directory Certificate Services were unable to build a new certificate or certificate chain: %1.
15	Error	Active Directory Certificate Services did not start: Version does not match certif.dll.
16	Error	Active Directory Certificate Services did not start: Unable to initialize OLE: %1.
17	Error	Active Directory Certificate Services did not start: Unable to initialize the database connection for %1. %2.
19	Error	Active Directory Certificate Services did not start: The Subject Name Template string in the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate is invalid. An example of a valid string is: CommonName OrganizationalUnit Organization Locality State Country
20	Error	Active Directory Certificate Services did not start: The Certificate Date Validity Period string in the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\ValidityPeriod is invalid. Valid strings are "Seconds", "Minutes", "Hours", "Days", "Weeks", "Months" and "Years".
21	Error	Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3.
22	Error	Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3. Additional information: %4
23	Error	Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3. The certificate would contain an encoded length that is potentially incompatible with older enrollment software. Submit a new request using different length input data for the following field: %4
25	Information	Active Directory Certificate Services revoked the certificate for request %1 for %2.
26	Information	Active Directory Certificate Services for %1 was started.%2%3
27	Error	Active Directory Certificate Services did not start: Hierarchical setup is incomplete. Use the request file in %1.req to obtain a certificate for this Certificate Server, and use the Certification Authority administration tool to install the new certificate and complete the installation.
33	Error	Active Directory Certificate Services did not start: Could not create the Certificate Server service thread for %1. %2.
34	Error	Active Directory Certificate Services did not start: Could not initialize RPC for %1. %2.
35	Error	Active Directory Certificate Services did not start: Could not initialize OLE for %1. %2.
38	Information	Active Directory Certificate Services for %1 was stopped.
39	Error	Active Directory Certificate Services did not start: The Certification Authority DCOM class for %1 could not be registered. %2. Use the services administration tool to change the Certification Authority logon context.
40	Error	Active Directory Certificate Services did not start: Could not initialize DCOM class factories for %1. %2.
42	Error	Could not build a certificate chain for CA certificate %3 for %1. %2.
43	Error	The "%1" Policy Module "%2" method caused an exception at address %4. The exception code is %3.
44	Error	The "%1" Policy Module "%2" method returned an error. %5 The returned status code is %3. %4
45	Error	The "%1" Exit Module "%2" method caused an exception at address %4. The exception code is %3.
46	Error	The "%1" Exit Module "%2" method returned an error. %5 The returned status code is %3. %4
48	Warning	Revocation status for a certificate in the chain for CA certificate %3 for %1 could not be verified because a server is currently unavailable. %2.
49	Warning	A certificate in the chain for CA certificate %3 for %1 could not be verified because no information is available describing how to check the revocation status. %2.
51	Error	A certificate in the chain for CA certificate %3 for %1 has been revoked. %2.
52	Information	Active Directory Certificate Services issued a certificate for request %1 for %2. Additional information: %3
53	Warning	Active Directory Certificate Services denied request %1 because %2. The request was for %3. Additional information: %4
54	Information	Active Directory Certificate Services left request %1 pending in the queue for %2. Additional information: %3
56	Information	Active Directory Certificate Services denied request %1. The request was for %2.
57	Information	Active Directory Certificate Services denied request %1. The request was for %2. Additional information: %3
58	Error	A certificate in the chain for CA certificate %3 for %1 has expired. %2.
59	Error	Active Directory Certificate Services did not start: Could not connect to the Active Directory for %1. %2.
60	Error	Active Directory Certificate Services refused to process an extremely long request from %1. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize registry parameter via certutil -setreg CA\MaxIncomingMessageSize . Unless verbose logging is enabled, this error will not be logged again for 20 minutes.
62	Warning	Active Directory Certificate Services had problems loading valid CRL publication values and has reset the CRL publication to its default settings.
63	Error	Active Directory Certificate Services did not start: %1 %2.
64	Error	Active Directory Certificate Services cannot publish enrollment access changes to Active Directory.
65	Error	Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location: %2. %3.%5%6
66	Error	Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location: %2. %3.%5%6
67	Error	Active Directory Certificate Services made %1 attempts to publish a CRL and will stop publishing attempts until the next CRL is generated.
68	Information	Active Directory Certificate Services successfully published Base CRL(s).
69	Information	Active Directory Certificate Services successfully published Delta CRL(s).
70	Information	Active Directory Certificate Services successfully published Base and Delta CRL(s).
71	Information	Active Directory Certificate Services successfully published Base CRL(s) to server %1.
72	Information	Active Directory Certificate Services successfully published Delta CRL(s) to server %1.
73	Information	Active Directory Certificate Services successfully published Base and Delta CRL(s) to server %1.
74	Error	Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
75	Error	Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location on server %4: %2. %3.%5%6
76	Information	The "%1" Policy Module logged the following information: %2
77	Warning	The "%1" Policy Module logged the following warning: %2
78	Error	The "%1" Policy Module logged the following error: %2
79	Warning	Active Directory Certificate Services could not publish a Certificate for request %1 to the following location: %2. %3.%5%6
80	Warning	Active Directory Certificate Services could not publish a Certificate for request %1 to the following location on server %4: %2. %3.%5%6
81	Error	Active Directory Certificate Services key archival is only supported on Advanced Server. %1
82	Error	Active Directory Certificate Services could only verify %1 of %2 key recovery certificates required to enable private key archival. Requests to archive private keys will not be accepted.
83	Error	Active Directory Certificate Services encountered an error loading key recovery certificates. Requests to archive private keys will not be accepted. %1
84	Error	Active Directory Certificate Services will not use key recovery certificate %1 because it could not be verified for use as a Key Recovery Agent. %2 %3
85	Warning	Active Directory Certificate Services ignored key recovery certificate %1 because it could not be loaded. %2 %3
86	Warning	Active Directory Certificate Services could not use the provider specified in the registry for encryption keys. %1
87	Error	Active Directory Certificate Services could not use the default provider for encryption keys. %1
88	Warning	Active Directory Certificate Services switched to the default provider for encryption keys. %1
90	Error	%1: Active Directory Certificate Services detected an exception at address %2. Flags = %3. The exception is %4.
91	Error	Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access.
92	Error	Active Directory Certificate Services could not update security permissions. %1
93	Warning	The certificate (#%1) of Active Directory Certificate Services %2 does not exist in the certificate store at CN=NTAuthCertificates,CN=Public Key Services,CN=Services in the Active Directory's configuration container. The directory replication may not be completed.
94	Warning	Active Directory Certificate Services %1 cannot open the certificate store at CN=NTAuthCertificates,CN=Public Key Services,CN=Services in the Active Directory's configuration container.
95	Error	Security permissions are corrupted or missing. The Active Directory Certificate Services may need to be reinstalled.
96	Error	Active Directory Certificate Services could not create an encryption certificate. %1. %2.
97	Warning	Active Directory Certificate Services %1 will reduce the maximum lifetime of the issued certificate for request %2 because the CA certificate lifetime is shorter than the registry validity period. Consider renewing the CA certificate or reducing the registry validity period.
98	Error	Active Directory Certificate Services encountered errors validating configured key recovery certificates. Requests to archive private keys will no longer be accepted.
99	Error	Active Directory Certificate Services could not create cross certificate %1 to certify its own root certificates. %2. %3.
100	Error	Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. %1 %2.
101	Information	Active Directory Certificate Services created CA cross certificate %2 for %1.
102	Error	Active Directory Certificate Services could not create cross certificate %1 to certify its own root certificates. The %2 extension is inconsistent. %3. %4.
103	Warning	Active Directory Certificate Services added the root certificate of certificate chain %1 to the downloaded Trusted Root Certification Authorities Enterprise store on the CA computer. This store will be updated from the Certification Authorities container in Active Directory the next time Group Policy is applied. To verify that the CA certificate is published correctly in Active Directory, run the following command: certutil -viewstore "%2" (you must include the quotation marks when you run this command). If the root CA certificate is not present, use the Certificates console on the root CA computer to export the certificate to a file, and then run the following command to publish it to Active Directory: Certutil -dspublish rtificatefilename% Root.
104	Information	Active Directory Certificate Services published certificate %1 to %2.
105	Information	Active Directory Certificate Services deleted invalid certificate %1 from %2.
106	Warning	Active Directory Certificate Services cannot add certificate %1 to %2. %3. %4.
107	Warning	Active Directory Certificate Services cannot delete invalid certificate %1 from %2. %3. %4.
108	Warning	Active Directory Certificate Services could not delete a Certificate for request %1 from the following location: %2. %3.%5%6
109	Warning	Active Directory Certificate Services could not delete a Certificate for request %1 from the following location on server %4: %2. %3.%5%6
110	Warning	Active Directory Certificate Services could not initialize the performance counters.
111	Error	Active Directory Certificate Services upgrade failed because the upgrade path could not be determined. %1
112	Error	Active Directory Certificate Services upgrade failed because information required for the upgrade was unavailable. %1
113	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not create CertEnroll folder and/or shared folder with proper permissions. %1
114	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not create virtual roots. %1
115	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not update server registry entries. %1
116	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not create web configuration file. %1
117	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not create revocation page. %1
118	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not upgrade key containers. %1
121	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not install new templates. %1
122	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not update service description. %1
123	Warning	A portion of the Active Directory Certificate Services upgrade failed: Could not update security settings. %1
124	Information	Active Directory Certificate Services upgrade succeeded. Active Directory Certificate Services settings have been upgraded successfully.
125	Error	Active Directory Certificate Services upgrade failed. Active Directory Certificate Services settings have not been upgraded. %1
126	Error	Current information about advanced features supported by this Certification Authority is not available from the domain controller. Stop and restart Certificate Services in order to update this information. %1
127	Error	Key recovery certificate %1 is about to expire soon and will not be used upon expiration. Contact your adminstrator to renew this certificate. %2 %3
128	Warning	An Authority Key Identifier was passed as part of the certificate request %1. This feature has not been enabled. To enable specifying a CA key for certificate signing, run: "certutil -setreg ca\UseDefinedCACertInRequest 1" and then restart the service.
129	Warning	An invalid OID has been detected in the EnabledEKUForDefinedCACert configuration setting. To resolve, run: "certutil -getreg ca\EnabledEKUForDefinedCACert" to identify the invalid OID and correct it. The default OID ("1.3.6.1.5.5.7.3.9") will be used.
130	Error	Active Directory Certificate Services could not create a certificate revocation list. %1. This may cause applications that need to check the revocation status of certificates issued by this CA to fail. You can recreate the certificate revocation list manually by running the following command: "certutil -CRL". If the problem persists, restart Certificate Services.
131	Warning	An invalid OID has been detected in the EKUOIDsForPublishExpiredCertInCRL configuration setting. To resolve, run: "certutil -getreg ca\EKUOIDsForPublishExpiredCertInCRL" to identify the invalid OID and correct it. The default OIDs ("1.3.6.1.5.5.7.3.3" and "1.3.6.1.4.1.311.61.1.1") will be used.
132	Error	The certification authority (CA) was unable to perform a decryption operation. This error can occur when an advanced encryption algorithm such as Advanced Encryption Standard (AES) is used and the CA has not been configured to use a CryptoAPI Next Generation (CNG) key storage provider. If this error occurred during certificate enrollment, check the certificate template to ensure that advanced encryption for key archival is not enabled.
133	Error	The certification authority (CA) failed to encode a server extension required to validate a certificate or certification revocation list (CRL). The CA will not issue any certificates or CRLs that do not contain this extension. To correct this problem, use the Certification Authority snap-in to remove any Unicode characters in the URLs for the AIA, CDP, and IDP extensions, then restart the CA.
134	Information	A certificate in the chain for CA certificate %3 for %1 has expired. %2.

Related links:

• Overview of Windows events generated by the online responder (OCSP)
• Overview of Windows events generated by the Network Device Enrollment Service (NDES).
• Overview of Windows events generated by the Certificate Enrollment Policy (CEP) service
• Overview of Windows events generated by the Certificate Enrollment Web Service (CES).

External sources

• Windows Event Log Messages (WELM) (GitHub)