The certification authority service does not start and throws the error message "The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)."
Assume the following scenario:
- A certification authority is implemented in the network.
- The certification authority service does not start.
- When trying to start the certification authority service, you get the following error message:
The data is invalid. 0xd (WIN32: 13 ERROR_INVALID_DATA)
A corresponding event no. 100 can also be found in the Event Viewer of the certification authority:
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. ADCS Labor Issuing CA 3 The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA).
Solution
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
Usually this error occurs when the CACertHash value in the registry of the certification authority cannot be processed. The configuration entry is located under the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{Name-der-Zertifizierungsstelle}
CACertHash invalid
In this case, the CACertHash value in the registry was invalid. Old certification authority certificates were deleted instead of being replaced by a hyphen.
CACertHash contains duplicate entries
If something goes wrong during the installation of the certification authority certificate, the CACertHash value may contain the certification authority certificate multiple times.
