Certificate for local system with Thumbprint is about to expire or already expired.
I opened the mmc console, added certificates for local and immediately found the certificate with matching thumbprint under
Issued to SRV014.corp.dom, Issued by CORP-SRV04-CA
Expiration date was 4 days ago.
Issue is, I don’t know how to manually renew this (if possible). CORP-SRV04-CA server is no longer in our environment.
I have option for request certificate with new key which pops up the certificate enrollment wizard. 2nd screen for requesting certificates shows Active directory enrollment policy
Domain Controller STATUS: Unavailable
Cannot find object or property.
A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.
Stuck and can’t seem to do anything. 2 questions are, what has broke or won’t function with things in this state? Also how do I fix it or do anything with it when the server listed it’s issued by isn’t valid anymore and was recycled probably 6 months ago?
Thanks for any help.
Все ответы
Hello, Thank you for posting in our TechNet forum.
Based on the description, I understand the certificate issued to SRV014.corp.dom and ssued by CORP-SRV04-CA is expired 4 days ago.
Question 1: I don’t know how to manually renew this (if possible). CORP-SRV04-CA server is no longer in our environment. A:We can not renew the expired certificate issued by your internal CA server even though CORP-SRV04-CA server is running and healthy in your environment. If CORP-SRV04-CA server is running and healthy in your environment, we can enroll a new certificate for SRV014.corp.dom again using CORP-SRV04-CA server. CORP-SRV04-CA server is no longer in your environment, do you have other CA server in your environment? If so, we can enroll a new certificate for SRV014.corp.dom again using that CA server. If we do not have any CA server in your environment, do we need this expired certificate again?
Question 2: I have option for request certificate with new key?
A:How do you request certificate? Do you have your healthy internal CA server?
Question 3: What has broke or won’t function with things in this state? Also how do I fix it or do anything with it when the server listed it’s issued by isn’t valid anymore and was recycled probably 6 months ago? A:What is the purpose of this expired certificate? Do you need this certificate to make a certain function work? If so, we should rebuild a CA server and enroll such certificate using the CA server.
This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.
Asked by:
Question
A certificate is about to or has expired, thats about the jist of things, i’ve seen this two days in a row now in the event viewer, strangely enough the thumpprint is different each day.
ObjId
54 6f a8 8c 85 2e db fc 5b 60 7e 28 ea e0 73 71 3b c6 e8 7c
However the GUID remains the same : F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43 (not sure if that helps actually)
Now i’ve naturally looked this up before i came here but i cant solve it so far.
I’ve ran MMC and i’ve looked at every certificate list i can find, but the thumpprint.. how do recognise it?
Every certificate is listed as a normal name, not numbers.
And the only certificate i suspect MIGHT be the culprit, is the new XBL certificate, that seems to want an update every single day. (so yesterday it was valid untill 21-10, today it says 22-10, which seems highly irregular to me, hence my suspicion)
But it doesnt seem to match the thumpprint, is it literally supposed to say 54 6f etcetc? or is there another way im supposed to Uncover that?
I’m not a complete «noob» but this is definitely new to me. 😛
Just to be clear, im on a normal windows 10 home edition thats been upgraded from creators update to, eventually, the fall update.
Thats when the «trouble» started, and i’ve already asked on «microsoft answers», but they directed me here, also im Dutch, so excuse my english if i mistakenly mistranslated something, but i think you get what the issue is.
Edit : i’ve also looked in the regedit and browsed the systemcertificate folders.
None of the folder names match the GUID or the thumpprint as far as i could tell.
The XBL certificate i mentioned, isnt listed amongst them, so maybe thats sitting somewhere else in the regedit.
Which to me seems more and more the culprit, also considering its only been going on the next day after the fall update, XBL services are installed since 18-10 according to apps and programs etc., 19-10 the messages started popping up when i turned on the computer. (i Always check eventviewer when i start it up, especially after big updates)
Every other certificate i can find is either expired years ago, the «shortest» time ago seems to be stemming from 19-4-2017, but thats not the one either.
Every other one is either listed as 2018 or well beyond.
Certificate for local system with Thumbprint f4 51 39 57 e7 c9 36 80 06 e0 11 05 40 fd 51 c6 85 5f b1 71 is about to expire or already expired.
Certificate for local system with Thumbprint 8a b5 24 68 ae 1a fa 8c 1a 60 63 14 b3 48 81 82 3b 6f 97 56 is about to expire or already expired. is this something I need to fix what would you suggest
Ответы
This is not a question we can answer for you. You would need to look at that certificate and determine what it is being used for. If its not being used or you don’t know why its there, then it may be unneeded and nothing needs to be done.
If this is server 2012 R2 or Windows 8+, you can run certlm.msc and look in Certificates\Personal to see the certificate and determine its purpose.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com
Все ответы
This is not a question we can answer for you. You would need to look at that certificate and determine what it is being used for. If its not being used or you don’t know why its there, then it may be unneeded and nothing needs to be done.
If this is server 2012 R2 or Windows 8+, you can run certlm.msc and look in Certificates\Personal to see the certificate and determine its purpose.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com
Thanks for your reply mark greatly appreciated I have many other things I need to fix 15 errors in total and 7 warnings as well so peace of mind puts my mind to ease a little will that command also work on windows 7 or what is different about 2012 R2 compared to windows 7 I understand they are different operating systems entirely since server 2012 r2 is virtual? don’t get me wrong but if that command works on windows 8 and up as well as server 2012 r2 then why would it not work on windows seven? which was made after server 2012? Unless windows seven was made before? That being said the errors I would like to try to fix on my own before asking for help as I have a good knowledge now about what I am doing and if I don’t know I put in the hours to find out before messing around as I have learnt from past experience do not wing it if you don’t know don’t touch! my next question though are audit success in the management console a good thing or bad a bit of both or nothing to worry about? I’m not to concerned but I know nothing about that particular area and I would like to know more under audit failure I only have 2 in the past 7 days? so is that something to be concerned about or no what is an audit and what is the difference between audit success and failure and do they need attention or is it really nothing at all?
under information I have 184 in the past hour 724 in the past 24 hours and 6,046 in the past seven days should I pay any attention to anything under hear at all or is it safe to just let it be? I’m trying to fix my computer in tip top shape I had to fix a lot as it had a lot wrong with it its defiantly running better now but any advice I can receive is great advice. 🙂
Ps I know the difference between success and failure what I don’t know is what the hell audits are?
I have spent months working on this and nothing works. So far, there is nothing even on the Internet that works. All I get is launch MMC add in the snap-in of Certificates and look for out of date certificates and renew. Well, when I go to renew what I see I get this error ;
This is becoming a big pain in my side and a pain in my clients rear.
Thanks for any new input anyone has on this.
I also have another issue which I will be putting in another post that is also eating up time trying to chase down a fix.
Answers
According to your description, my understanding is that SBS 2011 Standard logged Event ID 64 with source Microsoft-Windows-CertificateServicesClient-AutoEnrollment, and manually renew prompts Unavailable error.
A computer certificate on a managed computer, not a certification authority (CA), must be renewed when it passes 90 percent of its validity period or has expired. Because a successful renewal will generally be initiated before the certificate reaches 90 percent of its lifetime. Event ID 64 indicates that there may be a problem automatically obtaining a new certificate via autoenrollment. And we may try to manually renew a CA certificate.
This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.
Answered by:
Question
Our old enterprise root CA is no longer is service, so our domain controllers cannot renew their expired certificates as a «valid certification (CA) configured to issue certificates based on this template cannot be located. «
Since the original Enterprise CA cannot be recovered, can I make one of our new DCs an Enterprise Root CA? I’m thinking that it will then be able to issue new certificates and I can delete these old expired certificates?
Answers
Its best practice not to install any other roles in the domain controller. Moreover after installing ADCS role on your DC the Domain Controller can no longer be renamed or demoted.
Is your old CA functional? If the new CA(which you are going to configure) is the only CA in your environment then the domain controller certificate should be auto-enrolled.
If its not auto-enrolling please check:
1) If the Domain Controller template is configured for auto-enrollment for domain controller machines.
2) If the CA is configured to Issue the domain controller template.
3) If auto-enrollment feature is configured for computer accounts for your domain.
4) Do a gpupdate /force.
You can refer to the below link for cleaning up expired domain controller certificates, but before deleting this make sure its safe to delete this certificate:
