Certificate Authority - Expired certificate problems

-

when trying renew iis ssl our certificate authority received access denied error. logged on our ca server , found our ca certificate due expire in april (less 6 months away) , assumed causing ca not issue new certificate less year.

we tried renew our ca certificate threw error (still looking exact error message). in event log had following error:

event id 58 - a certificate in chain ca certificate 0 britannia operator limited has expired.  a required certificate not within validity period when verifying against current system clock or timestamp in signed file. 0x800b0101 (-2146762495).

after more reading pointed towards pkiview , able see several issues:

under root of our ca name found following conditions:

"cdp location #1" - expiring

"deltacrl location #1" - expired

i ran "manage ad containers" , under "certification authorities container" we're seeing 2 objects our ca name, once of has status of "not time valid" , other "ok". cdp tab confirms above status of cdp/deltacrl includes 3rd basecrl we're assuming legacy configuration (points old server , expired).

one interesting thing noticed under "aia container" tab certificates 0 - 3 listed should seeing new (4th) certificate listed assume?

my best guess ever reason renewal of ca failed update db , therefore whole system confused due lack of new cert?

what should next step here? i'm off more forum trawling figured worth asking here see if can point me in right direction.

many thanks,

simon

-simon

this resolved, delta crl returned "ok" status end of day. morning able re-publish ca using certutil. mentioned above, no longer able renew certificates continue work , once expired create new certificates new ca.

i've made sure expiry date has been put in several calenders make sure doesn't re-occur :)

regards

simon

-simon



Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

Error: 0x80073701 when trying to add Print Services Role in Windows 2012 Standard

-
hello, i'm getting error when trying add print services role in windows 2012 standard. i'm getting same error whether use gui or powershell. this new server install. the powershell error follows: add-windowsfeature : request add or remove features on specified server failed. installation of 1 or more roles, role services, or features failed. the referenced assembly not found. error: 0x80073701 at line:1 char:1 + add-windowsfeature print-services + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     + categoryinfo          : invalidoperation: (@{vhd=; credent...name=localhost}:psobject) [install-windowsfeature],     exception     + fullyqualifiederrorid : dismapi_error__failed_to_enable_updates,microsoft.windows.servermanager.commands.addwind    owsfeaturecommand success restart needed exit code      feature result ------- -------------- ---------      -------------- false   no             failed         {} issue appreciated. hi, i think should st
Read more

Disconnecting from a Windows Server 2012 R2 file sharing session on a Windows 7,8,10 machine

-
i've been trying disconnect server while , haven't been able to. there quick way this? i've used net session , net user , work sometime never consistent. can task? hi yrusad, thanks post. does work when check “computer management > system tools > shared folders > open files/sessions”. directly manage from gui. and based on knowledge, quick way mentioned net session /delete /y. mean never consistent? best regards, mary please remember mark replies answers if , unmark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com . Windows Server  >  Windows Server 2012 General
Read more

Event ID 64,77,1008 Certificates Events Windows Server 2008, 2008R2

-
hi guys, i need event ids. event id 64 clear - expired certificate. problem computers have new certificate ca of them keep old one. can remove them certificate store on computers or should check before? event id 77 - 1 strange me. warning , in same time don't see suspicious: "windows default" policy module logged following warning: active directory connection <domain controller name> has been reestablished <domain controller name>. have 4 dcs. should check or ignore these messages. event id 1008 - "certificate services client: credential roaming not performed because number of tokens in local store has exceeded limit." - i've checked articles credential roaming i'm not sure should do. if give tips , answers, great. in advance. hi, event id 64 clear - expired certificate. problem computers have new certificate ca of them keep old one. can remove them certificate store on computers or should check before? i assume these
Read more