Collection Rule for event with source CertificationAuthority and ID 130 Rule

  • ID:  Microsoft.Windows.CertificateServices.CARole.6.3.CertSvcEvents.130
  • Description:  Certificate Services could not create a certificate revocation list (CRL).
  • Target:  Certificate Service (2012 R2)
  • Enabled:  On Essential Monitoring

Overridable Parameters

Parameter Name Default Value Description Override
Priority 2  
Severity 2  

Run As Profiles

Name
Default

Alert Details

Message Priority Severity
AD CS Certificate Revocation List (CRL) Publishing High Critical

Rule Knowledgebase

Summary

Providing clients with the information that they need to determine whether to trust a certificate is one of the most important security functions of a certification authority (CA) and public key infrastructure (PKI). For the administrator, this means promptly revoking untrusted certificates that have not reached their scheduled expiration dates and publishing this information in certificate revocation lists (CRLs). Monitoring and addressing problems with CRL publication and availability is a critical aspect of PKI security.

Causes
This rule does not contain any causes.
Resolutions

Create a certificate revocation list

Active Directory Certificate Services (AD CS) could not create a certificate revocation list (CRL), which may cause applications that need to check the revocation status of certificates issued by this certification authority (CA) to fail.

The event log message should contain more specific information regarding the CRL creation failure. To correct this error:

  • Fix any problems listed in the event log message.

  • Try to create a CRL manually.

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Create a CRL

To manually create a CRL by using the Certification Authority snap-in:

  • On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.

  • In the console tree, click Revoked Certificates.

  • On the Action menu, point to All Tasks, and click Publish. 

  • Select New CRL to overwrite the previously published CRL, or select Delta CRL only to publish a current delta CRL.

  • Click OK.

To manually create a CRL by using the Certutil command-line tool:

  • On the computer hosting the CA, click Start, type cmd and press ENTER.

  • Type certutil -CRL and press ENTER.

If attempts to manually create a CRL fail, select the CA name in the the Certification Authority snap-in, and click Restart. Then, attempt to create the CRL again.

External References
This rule does not contain any external references.

See Also for Active Directory Certificate Services Management Pack


Downloads for Active Directory Certificate Services Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED