Home
  •  

Alert for event Id: 32043 ('ES_E_HTTP_INVALID_CLIENT_CERT_SUBJECT')

Microsoft.LS.2013.Monitoring.Rule.InfoEvent.Registrar.ES_E_HTTP_INVALID_CLIENT_CERT_SUBJECT (Rule)

Knowledge Base article:

Summary

Unknown Server Name in incoming HTTPS certificate.

Causes

A connection attempt from an unknown server was rejected. This can happen if the certificate subject name is is not recognized as a trusted server. This can also happen if the remote server certificate is not configured correctly. The certificate serial number is attached for reference.

Resolutions

Please check the remote server and ensure that the certificate is valid. Also ensure that the remote server is a trusted server.

Element properties:

TargetMicrosoft.LS.2013.Component.Registrar
CategoryEventCollection
EnabledTrue
Event_ID32043
Event SourceLS User Services
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityLow
RemotableTrue
Alert Message
[LYNC] Unknown Server Name in incoming HTTPS certificate.
{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.
Event LogLync Server

Member Modules:

ID Module Type TypeId RunAs 
CollectEvent DataSource Microsoft.Windows.EventProvider Default
WriteAlert WriteAction System.Health.GenerateAlert Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.LS.2013.Monitoring.Rule.InfoEvent.Registrar.ES_E_HTTP_INVALID_CLIENT_CERT_SUBJECT" Enabled="true" Target="Microsoft.LS.2013.Component.Registrar" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="CollectEvent" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Lync Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LS User Services</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">32043</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Alert_Unknown_Server_Name_in_incoming_HTTPS_certificate."]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>