Collection Rule for event with source CertificationAuthority and ID 58 (Error)

Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.58_Error (Rule)

A certificate in the chain for the CA certificate has expired.

Knowledge Base article:

Summary

Chain or path validation is the process by which end-entity (user or computer) certificates and all certification authority (CA) certificates are processed hierarchically until the certificate chain terminates at a trusted, self-signed certificate. Typically, this is a root CA certificate. Active Directory Certificate Services (AD CS) startup can fail if there are problems with availability, validity, and chain validation for the CA certificate.

Resolutions

Reissue certificates in the chain for an expired CA certificate

The certification authority (CA) certificate that has expired will be identified in the event log. To resolve this issue:

Check whether the certificate has expired.
Confirm the certificate chain.
If the problem persists, enable CryptoAPI 2.0 Diagnostics, resolve any errors found, and then reissue and reinstall the expired certificates.

To perform these procedures, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Check CA certificate expiration

To check whether a specific CA certificate has expired:

On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.
Right-click the CA node, and click Properties.
Expired certificates will be listed with the word (expired) in the list of CA certificates. If all CA certificates are expired, you will have to renew the CA certificate and reissue any certificates below the expired CA certificate.
To renew the CA certificate, right-click the CA node, point to All Tasks, and click Renew CA Certificate.
After the CA certificate has been renewed, restart the CA.
If there are unexpired certificates in the list, find the certificate whose CA Version number matches the key ID in the error message. For example, if the key ID is 2, the certificate with CA Version 2.1 or 2.2 would be the correct certificate.
If this certificate has not expired, check for problems with the certificate chain. Export the certificate to a file, and then open a command prompt window, type certutil -urlfetch -verify<CAcert.cer> and press ENTER. (Replace CAcert.cer with the name of the certificate file.)

Enable CryptoAPI 2.0 Diagnostics

To enable CryptoAPI 2.0 Diagnostics:

On the computer hosting the CA, click Start, point to Administrative Tools, and click Event Viewer.
In the console tree, expand Event Viewer, Applications and Services Logs, Microsoft, Windows, and CAPI2.
Right-click Operational, and click Enable Log.
Click Start, point to Administrative Tools, and click Services.
Right-click Active Directory Certificate Services, and click Restart.

Additional

To confirm that the certification authority (CA) certificate and chain are valid:

On the computer hosting the CA, click Start, type mmc, and then press ENTER.
If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
On the File menu, click Add/Remove Snap-in, click Certificates, and then click Add.
Click Computer account, and click Next.
Click Finish, and then click OK.
In the console tree, click Certificates (Local Computer), and then click Personal.
Confirm that a CA certificate that has not expired exists in this store.
Right-click this certificate and select Export to launch the Certificate Export Wizard.
Export the certificate to a file named Cert.cer.
Type Start, cmd and press ENTER.
Type certutil -urlfetch -verify <cert.cer> and press ENTER.
If no validation, chain building, or revocation checking errors are reported, the chain is valid.

Element properties:

Target

Microsoft.Windows.CertificateServices.CARole.2016

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Remotable

True

Alert Message

AD CS Certification Authority Certificate and Chain Validation - Certificate in CA chain has expired

Event Description: {0}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default
WriteToCertSvcEvents	WriteAction	Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default

Source Code:

<Rule ID="Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.58_Error" Enabled="true" Target="CSDisc!Microsoft.Windows.CertificateServices.CARole.2016" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-CertificationAuthority</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <And>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">58</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="Integer">EventLevel</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="Integer">1</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </And>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToCertSvcEvents" TypeID="Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher"/>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="AlertMessageIDa56c8730d300410882edc1f355f85f5d"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>