We have a couple of Windows 2008 SP2 servers running on a ESX 4.1 host. The problem is they have started to report are CAPI2 errors such as;
Log Name: Microsoft-Windows-CAPI2/Operational
Source: Microsoft-Windows-CAPI2
Date: 11/08/2011 09:39:23
Event ID: 41
Task Category: Verify Revocation
Level: Error
Keywords: Revocation,Path Validation
User: SYSTEM
Computer: ServerName.Domain
Description:
For more details for this event, please refer to the "Details" section
Event Xml:
Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"
System
Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}"
EventID41
Version 0
Level 2
Task 41
Opcode 2
Keywords 0x8000000000000005
TimeCreated SystemTime="2011-08-11T0 9:39:23.671125000Z"
EventRecordID 19338
Execution ProcessID="656" ThreadID="776"
Channel Microsoft-Windows-CAPI2/Operational
Computer ServerName.Domain
Security UserID="S-1-5-18"
System
UserData
CertVerifyRevocation
Certificate fileRef="1727E2E531E2AD1FA810311A2E516172C1000141.cer" subjectName="ServerName.Domain"
IssuerCertificate fileRef="1727E2E531E2AD1FA810311A2E516172C1000141.cer" subjectName="ServerName.Domain"
Flags value="8" CERT_VERIFY_REV_SERVER_OCSP_FLAG="true"
AdditionalParameters timeToUse="2011-08-11T09:39:23.671Z" currentTime="2011-08-11T09:39:23.671Z" urlRetrievalTimeout="PT15S"
RevocationStatus index="0" error="80092014" reason="0"
EventAuxInfo ProcessName="lsass.exe"
CorrelationAuxInfo TaskId="{D3D11046-EC99-4A4B-8281-838294A811AF}" SeqNumber="3"
Result value="80092014">The certificate is not in the revocation server's database.
I have tried the microsoft way of removing all cached certs and rebooting the server, I also know that McAfee can create this issue also.
Anyone have any other ideas.
Thanks
Darren.
