Collection Rule for event with source CertificationAuthority and ID 130

Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.130 (Rule)

Certificate Services could not create a certificate revocation list (CRL).

Knowledge Base article:

Summary

Providing clients with the information that they need to determine whether to trust a certificate is one of the most important security functions of a certification authority (CA) and public key infrastructure (PKI). For the administrator, this means promptly revoking untrusted certificates that have not reached their scheduled expiration dates and publishing this information in certificate revocation lists (CRLs). Monitoring and addressing problems with CRL publication and availability is a critical aspect of PKI security.

Resolutions

Create a certificate revocation list

Active Directory Certificate Services (AD CS) could not create a certificate revocation list (CRL), which may cause applications that need to check the revocation status of certificates issued by this certification authority (CA) to fail.

The event log message should contain more specific information regarding the CRL creation failure. To correct this error:

Fix any problems listed in the event log message.
Try to create a CRL manually.

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Create a CRL

To manually create a CRL by using the Certification Authority snap-in:

On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.
In the console tree, click Revoked Certificates.
On the Action menu, point to All Tasks, and click Publish.
Select New CRL to overwrite the previously published CRL, or select Delta CRL only to publish a current delta CRL.
Click OK.

To manually create a CRL by using the Certutil command-line tool:

On the computer hosting the CA, click Start, type cmd and press ENTER.
Type certutil -CRL and press ENTER.

If attempts to manually create a CRL fail, select the CA name in the the Certification Authority snap-in, and click Restart. Then, attempt to create the CRL again.

Additional

To confirm that certificate revocation list (CRL) publishing is working properly, perform the following procedure on a recently issued end-entity (user or computer) certificate:

Open a command prompt window on a computer that is connected to the network.
Type certutil -url <cert.cer> and press ENTER.

Replace <cert.cer> with the name of a certificate file that you created by exporting a certificate using the Certificate Export Wizard.

In the dialog box that appears, under Retrieve, click CRLs (from CDP), and click Retrieve.
Confirm that the status of all retrieved CRL distribution points is listed as Verified.

Element properties:

Target

Microsoft.Windows.CertificateServices.CARole.2016

Category

EventCollection

Enabled

True

Event_ID

130

Event Source

Microsoft-Windows-CertificationAuthority

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Remotable

True

Alert Message

AD CS Certificate Revocation List (CRL) Publishing - CRL creation failed

Event Description: {0}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToCertSvcEvents	WriteAction	Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default

Source Code:

<Rule ID="Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.130" Enabled="true" Target="CSDisc!Microsoft.Windows.CertificateServices.CARole.2016" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">130</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-CertificationAuthority</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToCertSvcEvents" TypeID="Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher"/>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="AlertMessageIDb3b9fe42f7824bf4af39db5341eb162d"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>