Chain or path validation is the process by which end-entity (user or computer) certificates and all certification authority (CA) certificates are processed hierarchically until the certificate chain terminates at a trusted, self-signed certificate. Typically, this is a root CA certificate. Active Directory Certificate Services (AD CS) startup can fail if there are problems with availability, validity, and chain validation for the CA certificate.
Publish a root CA certificate to Active Directory Domain Services
If the certification authority (CA) was installed very recently, one instance of this error can be considered normal.
If this error persists, or if clients detect similar errors, you can publish the root certificate to Active Directory Domain Services (AD DS) manually.
To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.
To publish a root CA certificate to AD DS:
On the computer hosting the CA, click Start, type cmd and press ENTER.
Type certutil -f -dspublish <CAcert.cer> RootCA and press ENTER.
The root CA certificate file can be found in %windir%\system32\certsrv\certenroll. Replace CAcert.cer with the name of the file containing the root CA certificate.