The following is an overview of the audit events generated by the Online Responder in the Windows Event Viewer.
In contrast to operational events, which are often understood under the term "monitoring", auditing for the certification authority is the configuration of logging of security-relevant events.
Continue reading "Overview of the audit events generated by the Online Responder (OCSP)"
In the default configuration, the Online Responder returns the status "Good" for requested certificates that do not appear on one of the configured certificate revocation lists.
This can be problematic because the Online Responder has no knowledge of the certificates issued by the certification authorities. If an attacker succeeds in issuing a certificate with the private key of the certification authority without its knowledge, the Online Responder would not detect this, and the certificate would also show up as "Good" in the audit log .
Continue reading "Configure deterministic "Good" for the Online Responder (OCSP)"
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5127 (0x1407) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | The OCSP Revocation Provider successfully updated the revocation information. CA Configuration ID: %1 Base CRL Number: %2 Base CRL This Update: %3 Base CRL Hash: %4 Delta CRL Number: %5 Delta CRL Indicator: %6 Delta CRL This Update: %7 Delta CRL Hash: %8 |
| Event text (German): | Der OCSP-Antwortdienst hat die Sperrungsinformationen erfolgreich aktualisiert. Konfigurations-ID der Zertifizierungsstelle: %1 Basissperrlistennummer: %2 Basissperrliste, diese Aktualisierung: %3 Basissperrlistenhash: %4 Deltasperrlistennummer: %5 Deltasperrlistenanzeige: %6 Deltasperrliste, diese Aktualisierung: %7 Deltasperrlistenhash: %8 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5126 (0x1406) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Signing Certificate was automatically updated by the OCSP Responder Service. CA Configuration ID: %1 New Signing Certificate Hash: %2 |
| Event text (German): | Das Signaturzertifikat wurde automatisch vom OCSP-Antwortdienst aktualisiert. Konfigurations-ID der Zertifizierungsstelle: %1 Neuer Signaturzertifikathash: %2 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5125 (0x1405) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A request was submitted to OCSP Responder Service. |
| Event text (German): | An den OCSP-Antwortdienst wird eine Anforderung übermittelt. |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5124 (0x1404) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A security setting was updated on OCSP Responder Service. New Value: %1 |
| Event text (German): | Für den OCSP-Antwortdienst wurde eine Sicherheitseinstellung aktualisiert. Neuer Wert: %1 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5123 (0x1403) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A configuration entry changed in the OCSP Responder Service. Property Name: %1 New Value: %2 |
| Event text (German): | Im OCSP-Antwortdienst wurde ein Konfigurationseintrag geändert. Eigenschaftenname: %1 Neuer Wert: %2 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5122 (0x1402) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A Configuration entry changed in the OCSP Responder Service. CA Configuration ID: %1 New Value: %2 |
| Event text (German): | Im OCSP-Antwortdienst wurde ein Konfigurationseintrag geändert. Konfigurations-ID der Zertifizierungsstelle: %1 Neuer Wert: %2 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5121 (0x1401) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | OCSP Responder Service Stopped. |
| Event text (German): | Der OCSP-Antwortdienst wurde beendet. |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5120 (0x1400) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | OCSP Responder Service Started. |
| Event text (German): | Der OCSP-Antwortdienst wurde gestartet. |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5059 (0x13C3) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Key migration operation. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Cryptographic Parameters: Provider Name: %5 Algorithm Name: %6 Key Name: %7 Key Type: %8 Additional Information: Operation: %9 Return Code: %10 |
| Event text (German): | Schlüsselmigrationsvorgang. Antragsteller: Sicherheits-ID: %1 Kontoname: %2 Kontodomäne: %3 Anmelde-ID: %4 Kryptografische Parameter: Anbietername: %5 Algorithmusname: %6 Schlüsselname: %7 Schlüsseltyp: %8 Zusätzliche Informationen: Vorgang: %9 Rückgabecode: %10 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 5058 (0x13C2) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Key file operation. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Cryptographic Parameters: Provider Name: %5 Algorithm Name: %6 Key Name: %7 Key Type: %8 Key File Operation Information: File Path: %9 Operation: %10 Return Code: %11 |
| Event text (German): | Schlüsseldateivorgang. Antragsteller: Sicherheits-ID: %1 Kontoname: %2 Kontodomäne: %3 Anmelde-ID: %4 Kryptografische Parameter: Anbietername: %5 Algorithmusname: %6 Schlüsselname: %7 Schlüsseltyp: %8 Informationen zum Schlüsseldateivorgang: Dateipfad: %9 Vorgang: %10 Rückgabecode: %11 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 4900 (0x1324) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Certificate Services template security was updated. %1 v%2 (Schema V%3) %4 %5 Template Change Information: Old Template Content: %9 New Template Content: %7 Old Security Descriptor: %10 New Security Descriptor: %8 Additional Information: Domain Controller: %6 |
| Event text (German): | Die Sicherheit der Zertifikatdienstvorlage wurde aktualisiert. Die Zertifikatdienste haben eine Vorlage geladen. %1 v%2 (Schema V%3) %4 %5 Informationen zur Vorlagenänderung: Alter Vorlageninhalt: %9 Neuer Vorlageninhalt: %7 Alte Sicherheitsbeschreibung: %10 Neue Sicherheitsbeschreibung: %8 Zusätzliche Informationen: Domänencontroller: %6 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 4899 (0x1323) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A Certificate Services template was updated. %1 v%2 (Schema V%3) %4 %5 Template Change Information: Old Template Content: %8 New Template Content: %7 Additional Information: Domain Controller: %6 |
| Event text (German): | Die Zertifikatdienstvorlage wurde aktualisiert. %1 v%2 (Schema V%3) %4 %5 Vorlageninformationen: Vorlageninhalt: %7 Sicherheitsbeschreibung: %8 Zusätzliche Informationen: Domänencontroller: %6 |
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 4898 (0x1322) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Certificate Services loaded a template. %1 v%2 (Schema V%3) %4 %5 Template Information: Template Content: %7 Security Descriptor: %8 Additional Information: Domain Controller: %6 |
| Event text (German): | Die Zertifikatdienste haben eine Vorlage geladen. %1 v%2 (Schema V%3) %4 %5 Vorlageninformationen: Vorlageninhalt: %7 Sicherheitsbeschreibung: %8 Zusätzliche Informationen: Domänencontroller: %6 |