Certificate revocation list (CRL)

Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority


Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	74 (0x4A)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_BASE_CRL_PUBLICATION_HOST_NAME
Event text (English):	Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):	Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority


Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	66 (0x42)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_DELTA_CRL_PUBLICATION
Event text (English):	Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):	Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority


Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	65 (0x41)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_BASE_CRL_PUBLICATION
Event text (English):	Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):	Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority"

Basics: Checking the revocation status of certificates

If a valid, unexpired certificate is to be withdrawn from circulation, it must be revoked. For this purpose, the certification authorities maintain corresponding certificate revocation lists in which the digital fingerprints of the revoked certificates are listed. They must be queried during the validity check.

Continue reading "Basics: Checking the revocation status of certificates"

Performing a functional test for a certification authority

After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.

Continue reading "Performing a functional test for a certification authority"

Publishing a certificate revocation list (CRL) to an Active Directory CRL distribution point (CDP)

Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list. This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.

In some cases (for example, with an offline certification authority, or if non-standard LDAP CRL distribution points have been configured), the certificate revocation list must be manually published to Active Directory.

Continue reading "Publishing a certificate revocation list (CRL) to an Active Directory CRL distribution point (CDP)"

Create and publish a certificate revocation list

Sometimes it is necessary for a certificate issued by a certification authority to be taken out of service even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list (CRL). This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.

After a certificate has been revoked, a new CRL must be created and published so that entities that check the revocation status are informed of the revocation. Since the CRL has a relatively short expiration date, it must be reissued at regular intervals even if the content is not changed.

Continue reading "Create and publish a certificate revocation list"

Revoking an issued certificate

Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list (CRL). This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.

When a certificate is revoked, its serial number is placed on the CRL. Entities that check the revocation of a certificate then consider it to be no longer valid.

Continue reading "Revoking an issued certificate"

If a certification authority certificate has been revoked, a revocation list is no longer issued for the certification authority certificate

Assume the following scenario:

A certification authority has multiple certification authority certificates.
More than one certification authority certificate uses the same private key because, for example, the certification authority certificate was renewed with the same key pair.
If one of these certification authority certificates is revoked, the certification authority will also no longer issue certificate revocation lists (CRLs) for the other certification authority certificates that use the same key.

Continue reading "If a certification authority certificate has been revoked, a revocation list is no longer issued for the certification authority certificate"

What impact does the expiry of the CRL of one of the higher-level certification authorities have on the certification authority?

Unfortunately, in practice it happens from time to time that the certificate revocation list (CRL) of a higher-level certification authority expires and a renewal does not take place. This can also happen as planned, for example when an old hierarchy is decommissioned.

Continue reading "What impact does the expiry of the CRL of one of the higher-level certification authorities have on the certification authority?"

View and clear the address cache for certificate revocation lists (CRL URL Cache)

All applications that use the Microsoft Cryptographic Application Programming Interface Version 2 (Crypto API Version 2, CAPI2) have a mechanism for caching certificate revocation information (certificate revocation lists and OCSP responses).

Thus, there is no guarantee that, for example, a newly published CRL will be used by participants before the previous CRL, which is still in the cache, has expired.

The following describes how to view and influence the CRL cache.

Continue reading "View and clear the address cache for certificate revocation lists (CRL URL Cache)"

What impact does incorrect revocation information of a certification authority certificate have on the certification authority?

The following describes the effects on certification authority operation if the revocation information for one of the certification authority's certificates cannot be retrieved.

This case may also occur as planned, for example, when a previous certification authority hierarchy is to be decommissioned.

Continue reading "What impact does incorrect revocation information of a certification authority certificate have on the certification authority?"

The certification authority service does not start and throws the error message "The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)"

Assume the following scenario:

A certification authority is implemented in the network.
The certification authority service does not start.
When trying to start the certification authority service, you get the following error message:

The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)

Continue reading "The certification authority service does not start and throws the error message "The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)""

The certification authority service does not start and throws the error message "The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)"

Assume the following scenario:

A certification authority is implemented in the network.
The certification authority service does not start.
When trying to start the certification authority service, you get the following error message:

The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)

Continue reading "The certification authority service does not start and throws the error message "The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)""

Basics: Public Key Infrastructures (PKI)

A public key infrastructure comprises all components (hardware, software, people and processes) required for the use of digital certificates. A PKI consists of one or more certification authorities (CA). The tasks of a PKI include:

Ensuring the authenticity of keys, i.e. establishing a traceable link between a key and its origin to prevent misuse.
Revocation of certificates, i.e., ensuring that decommissioned or compromised (e.g., stolen) keys can no longer be used.
Ensuring accountability (non-repudiation), i.e., for example, that the owner of a key cannot deny that it belongs to him.
Enforcement of policies, i.e. standardized procedures for the use of certificates.

Continue reading "Basics: Public Key Infrastructures (PKI)"