Tag: certutil

Viewing the CRL table of the certification authority database

By default, the certification authority stores all certificate revocation lists (CRLs) that have not yet expired in the certification authority database.

Under certain circumstances, e.g. due to a misconfigured script, a large number of CRLs are stored in the database in this way, which can lead to a corresponding growth of the database (e.g. if large CRLs are recreated very often).

Continue reading "Viewing the CRL table of the certification authority database"

certutil -dcinfo fails with error message "KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

  • Domain controllers have certificates for LDAP over SSL.
  • The certificates do not include the Extended Key Usage "Smart Card Logon" or "Kerberos Authentication".
  • If you run certutil -dcinfo, the command reports the following error message:
0 KDC certificates for DC01
No KDC Certificate in MY store
KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

Continue reading "certutil -dcinfo fails with error message "KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Manual publishing of a certificate revocation list (CRL) to Active Directory fails with error 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)

Assume the following scenario:

  • An offline root certification authority has been installed. The server on which the certification authority is installed is not a domain member.
  • It is configured to publish certificate revocation lists (CRLs) to Active Directory.
  • The CRLs are uploaded to the Active Directory using certutil -dspublish.
  • The operation fails with the following error message:
certutil -dspublish "ADCS Labor Root CA.crl"
 ldap:///CN=ADCS Labor Root CA,CN=ADCS Labor Root CA,CN=cdp,CN=Public Key Services,CN=Services,DC=UnavailableConfigDN?certificateRevocationList?base?objectClass=cRLDistributionPoint?certificateRevocationList
 ldap: 0xa: LDAP_REFERRAL: 0000202B: RefErr: DSID-03100835, data 0, 1 access points
         ref 1: 'unavailableconfigdn'
 CertUtil: -dsPublish command FAILED: 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)
 CertUtil: A referral was returned from the server.

Continue reading "Manual publishing of a certificate revocation list (CRL) to Active Directory fails with error 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)"

Requesting a certificate fails with the error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted."

Assume the following scenario:

  • You try to request a certificate from an Active Directory integrated certification authority (enterprise CA).
  • To do this, you use the Microsoft Management Console (MMC), either for the logged-on user (certmgr.msc) or for the computer (certlm.msc).
  • However, the desired certificate template is not offered for selection, even though it has been correctly published on the certification authority.
  • The logged-on user (or computer) also has the necessary permissions to request certificates from the certificate template in question (Enroll).
  • In the list of available certificate templates within the MMC, you have all certificate templates displayed. The desired certificate template shows:
A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.

Continue reading "Requesting a certificate fails with the error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.""