Tag: Exit module

Operating the Certification Authority without an exit module

If a certification authority is installed, the "Windows Default" exit module is automatically activated. This enables e-mail messages to be sent when certain events occur at the certification authority. However, most companies do not use this feature at all.

However, even if the exit module is not used at all, it causes sessions on the certification authority database (see Event no. 46 ). On certification authorities with high load this can be problematic .

If the functions it offers are not used at all (the "Windows Default" exit module never works on Windows Server Core ), it can also be disabled completely.

Continue reading "Operating the Certification Authority without an exit module"

Restoring certificates from the SMTP Exit Module data

If you restore a certification authority from a backup after a disaster has occurred , you will probably find that certificates were issued in the period between the last backup and the system failure with corresponding data loss.

These certificates are now not stored in the restored certification authority database, so they cannot be restored if needed.

If you are using the SMTP Exit Module, you can at least determine the serial numbers of the certificates from the sent e-mails and revoke them.

Continue reading "Restoring certificates from the SMTP Exit Module data"

Create an exit module for the certification authority in C#

Microsoft Active Directory Certificate Services offers the possibility to develop your own policy and exit modules to extend the functionality of the certification authority.

Below are the steps necessary to create an exit module in C# using Visual Studio 2019. The exit module will write issued certificates to a configurable directory in the file system.

Continue reading "Create an exit module for the certification authority in C#"

Issuing certificates or CRLs fails with error code CERTSRV_E_NO_DB_SESSIONS

Assume the following scenario:

  • The certification authority cannot issue certificates and/or
  • The certification authority cannot issue certificate revocation lists (CRLs).
  • At least one of the following error messages is logged:

Event ID: 53 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services denied request 12345 because An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions. 0x8009400f (-2146877425 CERTSRV_E_NO_DB_SESSIONS). The request was for CN=Rudi Ratlos. Additional information: Denied by Policy Module

Event ID: 130 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services could not create a certificate revocation list. An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions 0x8009400f (-2146877425). This may cause applications that need to check the revocation status of certificates issued by this CA to fail. You can recreate the certificate revocation list manually by running the following command: "certutil -CRL". If the problem persists, restart Certificate Services.

Continue reading "Issuing certificates or CRLs fails with error code CERTSRV_E_NO_DB_SESSIONS"

The SMTP exit module does not work on Windows Server Core

Assume the following scenario:

  • A certification authority is installed on Windows Server Core.
  • The SMTP exit module supplied with the certification authority is configured.
  • However, the certification authority does not send e-mails.
  • In the event log, event no. 46 is logged with the following error message:
The "Windows default" Exit Module "Initialize" method returned an error. Class not registered The returned status code is 0x80040154 (-2147221164). The Certification Authority was unable to initialize email messaging objects.

Continue reading "The SMTP exit module does not work on Windows Server Core"

Combining the SMTP Exit Module with a local SMTP server for increased resilience

Assume the following scenario:

  • The certification authority is configured to use the SMTP exit module to send e-mail notifications about the events on the certification authority.
  • The configured SMTP server is not always reliably accessible, for example, because it is not designed to be highly available.
  • If the SMTP server fails, the certification authority will operate very slowly because the e-mail notifications cannot be delivered. In some circumstances, the certification authority service will no longer start.

Continue reading "Combining the SMTP Exit Module with a local SMTP server for increased resilience"

Disabling the SMTP Exit Module of a Certification Authority

Assume the following scenario:

  • The certification authority is configured to use the SMTP exit module to send e-mail notifications about the events on the certification authority.
  • The configured SMTP server is unreachable, for example due to a failure.

In this case, the exit module cannot deliver the email notifications. It will time out and the certification authority will work very slowly.

Continue reading "Disabling the SMTP Exit Module of a Certification Authority"