The certification authority service does not start and throws the error message "The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)"

Author Uwe Gradenegger Posted on Updated on Categories Troubleshooting, Certification Authority Tags Certificate revocation list (CRL), CRYPT_E_REVOKED

Assume the following scenario:

  • A certification authority is implemented in the network.
  • The certification authority service does not start.
  • When trying to start the certification authority service, you get the following error message:
The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)

Error dialog "Microsoft Active Directory Certificate Services": "The certificate is revoked." 0x80092010 (CRYPT_E_REVOKED)

A corresponding event no. 100 can also be found in the Event Viewer of the certification authority:

Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. ADCS Labor Issuing CA 3 The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED).

Event 100, CertificationAuthority: Active Directory Certificate Services did not start, 0x80092010 CRYPT_E_REVOKED

Cause

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

This error occurs only with the currently used certification authority certificate. The certification authority always uses the last of the installed certificates for issuing certificates. This error should not occur with the previous certification authority certificates.

The certification authority certificate has been revoked by the parent certification authority and may therefore no longer be used. Accordingly, the certification authority refuses to start the service.

Solution: Request a new certification authority certificate

The correct solution to this problem is to request and install a new certification authority certificate as soon as possible. The certificate request required for this can also be generated when the certification authority service is stopped. There is no workaround for this problem.