Collection Rule for event with source CertificationAuthority and ID 67

Summary

Providing clients with the information that they need to determine whether to trust a certificate is one of the most important security functions of a certification authority (CA) and public key infrastructure (PKI). For the administrator, this means promptly revoking untrusted certificates that have not reached their scheduled expiration dates and publishing this information in certificate revocation lists (CRLs). Monitoring and addressing problems with CRL publication and availability is a critical aspect of PKI security.

Resolutions

Enable CRL publication before the next CRL is generated

• Follow the procedure in the "Correct CRL distribution point problems" section to correct any problems with your certificate revocation list (CRL) distribution point information, including permissions problems.

• Follow the procedure in the "Confirm network connectivity" section to confirm that you have network connectivity to Active Directory Domain Services (AD DS) and computers hosting CRL distribution points.

Correct CRL distribution point problems

To review and correct problems with CRL distribution point address information:

• On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.

• Right-click the name of the certification authority (CA), and click Properties.

• Click the Extensions tab. Note the CRL distribution points for which the Publish CRLs to this location check box is selected.

• If a CRL publication location is not valid, replace it with a valid path.

• If the event log message specifies an Active Directory location that has been formatted as a Lightweight Directory Access Protocol (LDAP) address, use the procedure "Confirm Active Directory CRL distribution point permissions" to check that the CA has Write permissions to this location.

• If you are using custom network locations as CRL distribution points, confirm that the computer hosting the CA has Write access to the drive that contains the operating system on the other computer.

To determine the configured CRL distribution points from the command line:

• Open a command prompt window on the CA.

• Type certutil -getreg ca\crlpublicationurls and press ENTER. 

Confirm Active Directory CRL distribution point permissions

To confirm Active Directory CRL distribution point permissions:

• On a compuater that has Active Directory management tools installed, click Start, point to Administrative Tools, and click Active Directory Sites and Services.

• On the View menu, click Show Services Node.

• Double-click Services, and double-click Public Key Services.

• Right-click AIA, and click Properties.

• Click the Security tab, and confirm that the CA has Write permission to this location.

Confirm network connectivity

To determine if there is a network connectivity problem between the CA and a domain controller:

• On the CA, click Start, type cmd and press ENTER.

• Type ping <server_FQDN>, where <server_FQDN> is the fully qualified domain name (FQDN) of the domain controller (for example, server1.contoso.com), and then press ENTER.

• If you can connect to the domain controller, you will receive a reply similar to the following:

Reply from IP_address: bytes=32 time=3ms TTL=59

Reply from IP_address: bytes=32 time=20ms TTL=59

Reply from IP_address: bytes=32 time=3ms TTL=59

Reply from IP_address: bytes=32 time=6ms TTL=59 

• At the command prompt, type ping <IP_address>, where <IP_address> is the IP address of the domain controller, and then press ENTER.

• If you can connect to the domain controller by IP address but not by FQDN, this indicates a possible issue with Domain Name System (DNS) host name resolution.

• If you cannot successfully connect to the domain controller by IP address, this indicates a possible issue with network connectivity.

• Check for and resolve any hardware problems, such as a malfunctioning network card or disconnected network cable, as well as any event log errors relating to firewall configuration Internet Protocol security (IPsec) configuration.

• Repeat this procedure for any CRL distribution points that are not domain controllers. 

Additional

To confirm that certificate revocation list (CRL) publishing is working properly, perform the following procedure on a recently issued end-entity (user or computer) certificate:

• Open a command prompt window on a computer that is connected to the network.

• Type certutil -url <cert.cer> and press ENTER.

Replace <cert.cer> with the name of a certificate file that you created by exporting a certificate using the Certificate Export Wizard.

• In the dialog box that appears, under Retrieve, click CRLs (from CDP), and click Retrieve.

• Confirm that the status of all retrieved CRL distribution points is listed as Verified.