PKI Certificate Validation Management Pack
Release Notes
Last updated for version: 1.4.3.0 – November, 2019

No support for Operations Manager 2007 R2
Starting with version 1.2.0.0, the PKI Certificate Validation MP does no longer support Operations Manager 2007 R2. The minimum requirements are:
•	Operations Manager 2012 / 2012 SP1 or 2012 R2
•	Powershell 2.0 installed on agents that need certificate monitoring.
The legacy version V 1.0.1.15 may continue to be used on SCOM 2007 R2 but it will not see any further development.

Optional Management Packs
Some the included management packs are optional. Only the core MP file SystemCenterCentral.Utilities.Certificates.mpb has be imported unless:
•	QuickStart overrides are desired: Import SystemCenterCentral.Utilities.Certificates.QuickStartOverrides.xml
•	Fast response rediscovery tasks are required: Import SystemCenterCentral.Utilities.Certificates.ReDiscoveryTasks.mpb
Please refer to the MP guide for more details about above, optional management packs.

Upgrading from V 1.2.2.x or earlier
Starting with version 1.3.0.0, the management pack contains an additional, disabled discovery for the “Web Hosting” store on Windows Server 2012 and later. The QuickStart override MP has been changed to automatically discover the “Personal (My)” computer store and the “Web Hosting” store on Windows servers. If you wish to monitor certificates in the Web Hosting stores you must either:

•	upgrade the QuickStart MP or
•	manually activate the Web Hosting store discovery by means of an override

To make use of the added “Template” filtering option, review any existing certificate store discovery overrides.

The alert format has changed. After upgrading the MP, any open alert will show parameter replacement issues (e.g. {0} in the alert description). To avoid this, reset the Health State of the related monitors. Open alerts will be closed and re-generated on the next monitoring cycle. The newly created alerts will then show the correct alert description.

Upgrading from V 1.2.1.x or earlier
With version 1.2.1.0, the logic of filtering certificate objects by issuer and subject has been enhanced and moved from the certificate discovery to the store discoveries (to assure cookdown) and 1.2.2.0 introduced filtering by certificate template. Should you have been using issuer and subject filters in previous versions, you will need to recreate those overrides. Please see the chapter Configure which certificates and CRLs are discovered in the MP guide. Verifying if such overrides are in place is possible by exporting the override MPs and searching for the old override property names:
•	IssuedToRegEx
•	IssuedByRegEx
As the additional properties were being added to the certificate store classes, monitoring of certificates may fail until the first full store discovery cycle has passed. This would normally happen within an hour. Temporarily seeing error events about unloaded MP workflows from this MP during that time is expected and does not indicate an issue with the management pack (event ID 1100).
You should be able keep any other existing override. Nonetheless it is recommended to export any existing MP with overrides to the PKI Certificate Validation MP and review them.

Direct upgrade from V 1.0.0.x is not possible
If a version 1.0.0.x MP is still installed, you will not be able to upgrade to the latest version. 
•	Export any override MPs referencing the old PKI Certificate Validation MP, keeping them to re-enable your custom settings at the end. 
•	Then remove the override MPs and the old PKI Certificate Validation MP itself.
•	Import the latest MP version
•	If required, recreate overrides as found in the exported files.

Discover additional Certificate Stores
The Management Pack will automatically discover and monitor any certificate and CRL once a certificate store has been discovered. Additional registry-based certificate stores may easily be monitored by adding a discovery to an extension Management Pack. The discovery must use the DataSource SystemCenterCentral.Utilities.Certificates.CertificateStoreDiscoveryProvider. The Management Pack is being deliverd with an example discovery extension in the file SystemCenter.Utilities.Certificates.Discovery.AddOn.xml. It shows how to discover the certificate store for Cisco ACS certificates. Any certificate store found at HKLM\SOFTWARE\Microsoft\SystemCertificates may be integrated by following that example.

Known Issues
Initial State Monitoring Delay
Certificate and CRL monitors will show an initialization state of Healthy (green) even if their actual state should be Warning or Critical. After initial discovery or ending maintenance mode, there is a delay of up to 15 minutes before the monitors will reflect the actual state of the object.
This is due to the timing settings of the Management Pack. All monitors run roughly every 4 hours and are configured with a randomized initialization delay of approximately 15 minutes per certificate store.
The monitor timings may be modified. See the section ‘Overriding certificate discovery and monitoring intervals’ in the Management Pack guide for detailed instructions.

Certificate Stores in Not Monitored State
The Certificate Stores Availability view may contain Certificate Stores with a state of Not Monitored (green circle without a tick). This happens when no Certificates or CRLs have been discovered in a store. Likewise, this could indicate that only certificates that are in the “Required for Windows” groups were found. Monitoring for any of those is disabled by default.

Certificate Stores State View
The state of the Certificate Store is represented by the Configuration Health Roll Up monitors of the Certificates and CRLs. If no such objects are present, the Store availability will remain in Not Monitored state.
If objects are missing, check if enabling a discovery or changing a discovery filter override is required. See section ‘Configuration of Certificate Discovery’ in the Management Pack guide for detailed information. 
Alternatively, you may disable discovery of an empty Certificate Store by setting an additional “disable” override. After running the OpsMgr Command Shell command ‘Remove-SCOMDisabledClassInstance’, the Certificate Store will disappear from the Operations Manager Console.

Mismatch between certificate snap-in (certmgr.msc) view and SCOM objects discovered
The certificate MP will only discover certificates and CRLs saved to a registry store. The default certificate snap-in view will display a combination of registry and upstream stores such as Trusted Root, Third-Party, Group Policy, Enterprise and Smart Card. Enabling the “Physical Certificate Store” view option will allow checking the actual location of certificates.

Enable physical certificate store view
The MP will only discover and monitor those certificates and CRLs seen in the “Registry” folder of each store.
Note that the discovery of self-signed certificates is disabled by default. The same is true for CA certificates located in the personal store (My).

Some state and the dashboard view(s) are not working correctly when SCOM User Roles are scoped
When user roles are scoped (e.g. to a subset of windows computers via a computer group), some views of the MP will not display correctly. This happens when the instance groups used to target the views, are not part of an operator’s scope. The user’s perception depends on the view type:
-	State Views: Fall back to not targeting the view, resulting in displaying all certificates respectively CRLs in a user’s scope. Effectively showing too many objects.
-	Dashboard: The view will fail to display any data.
A scoped operator can verify this by opening the properties of an affected state view (CRLs – Current). The console will display an error and display all CRLs in that view. This is a limitation of the Operations Manager Console. If affected by it possible workarounds include:
-	Do not include the following state views and the dashboard view in the “PKI Certificate Folder” in scoped user roles
o	Certificate and CRL Issues (Dashboard)
-	Add the certificate and CRL instance groups of the MP to the user role’s scope. The caveat being that such an operator will get access to all certificates or CRLs plus their alerts of the entire management group.

Certificate Template displayed as OID
It may happen that certificates issued by a Microsoft Windows Enterprise CA using a “Template” do not display the template name but only its OID value. This is the case when a certificate has been exported and reimported on a computer that is not a member of the AD forest that contains the Enterprise CA.

Certificate Template shown as OID
If available, the management pack will discover both the name of the template and the template’s OID. A fully resolved Certificate Template property of a locally resolvable V3 template certificate will look like this:
WebServer(1.3.6.1.4.1.311.21.8…)
Consider using the template OID instead of the template name when defining regular expressions for discovery filter overrides. This will avoid suffering from an inconsistent certificate object repository should the template names not be resolved on some agents (e.g. workgroup servers).

Certificate and Inventory Reports failing with ‘ColumnList’ value error
If a certificate or CRL inventory report is run against an empty certificate store, the reports fail with the following error message:
	The ‘ColumnList’ parameter is missing a value
If at least one store that hosts discovered certificates/CRLs is selected as a ‘Group’ target for the report, it will run successfully.
Likewise, other inventory reports may fail if no objects have been discovered. E.g. the “Expiring Certificates Report” will only work if there ate certificates present that will expire soon.