Collection Rule for event with source OnlineResponder and ID 17

Summary

The certfication authority (CA) database records all certificate transactions, including requests, the requester, and whether the request was granted or denied; information for the issued certificate, such as the private key, serial number, and expiration date; and information about revoked certificates. Problems accessing a CA database can prevent a CA from starting and functioning properly. 

Resolutions

Enable the connection between the CA and the certificates database

A certification authority (CA) needs to be able to connect to a certificates database file identified in the registry. To resolve this problem, confirm that the file identified in the registry exists, and if it does exist, that it has not been corrupted. 

To perform this procedure, you must have local administrator permission, or you must have been delegated the appropriate authority.

To enable the connection between the certification authority (CA) and the certificates database:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

• On the computer hosting the CA, click Start, type regedit, and then press ENTER.

• Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration.

• Check the value data for the REG_SZ entries named DBLogDirectory, DBSystemDirectory, and DBTempDirectory. Then, confirm that the CA database files exist in these locations.

• At a command prompt, type Esentutl.exe /g <databasename> and press ENTER to check for database corruption.

Replace databasename with the name of the database listed in the registry settings.

• If the database has been corrupted, at a command prompt, type Esentutl /r <databasename> and press ENTER to correct the problem.

• Restart Active Directory Certificate Services (AD CS).

Additional

To confirm that the CA database connection has been enabled:

• On the computer hosting the CA, click Start, point to Administrative Tools, and click Services.

• If Started is displayed in the Status column for the Active Directory Certificate Services service, the CA database connection has been enabled.