Active Directory Certificate Services published certificate.
Chain or path validation is the process by which end-entity (user or computer) certificates and all certification authority (CA) certificates are processed hierarchically until the certificate chain terminates at a trusted, self-signed certificate. Typically, this is a root CA certificate. Active Directory Certificate Services (AD CS) startup can fail if there are problems with availability, validity, and chain validation for the CA certificate.
AD CS published a CA certificate to Active Directory Domain Services
This behavior is by design.
Active Directory Certificate Services (AD CS) published the specified certification authority (CA) certificate to Active Directory Domain Services (AD DS).
This warning indicates that AD CS republished the CA certificate to AD DS because the certificate was not found in the AIA container (CN=AIA,CN=Public Key Services,CN=Services,DC=contoso,DC=com) in AD DS.
To confirm that the certification authority (CA) certificate and chain are valid:
On the computer hosting the CA, click Start, type mmc, and then press ENTER.
If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
On the File menu, click Add/Remove Snap-in, click Certificates, and then click Add.
Click Computer account, and click Next.
Click Finish, and then click OK.
In the console tree, click Certificates (Local Computer), and then click Personal.
Confirm that a CA certificate that has not expired exists in this store.
Right-click this certificate and select Export to launch the Certificate Export Wizard.
Export the certificate to a file named Cert.cer.
Type Start, cmd and press ENTER.
Type certutil -urlfetch -verify <cert.cer> and press ENTER.
If no validation, chain building, or revocation checking errors are reported, the chain is valid.
| Target | Microsoft.Windows.CertificateServices.CARole.2016 |
| Category | EventCollection |
| Enabled | True |
| Event_ID | 104 |
| Event Source | Microsoft-Windows-CertificationAuthority |
| Alert Generate | False |
| Remotable | True |
| Event Log | Application |
| ID | Module Type | TypeId | RunAs |
|---|---|---|---|
| DS | DataSource | Microsoft.Windows.EventProvider | Default |
| WriteToDB | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
Home
ENU <Rule ID="Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.104" Enabled="true" Target="CSDisc!Microsoft.Windows.CertificateServices.CARole.2016" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">104</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-CertificationAuthority</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
</WriteActions>
</Rule>