1

We have a couple of Windows 2008 SP2 servers running on a ESX 4.1 host. The problem is they have started to report are CAPI2 errors such as;

Log Name: Microsoft-Windows-CAPI2/Operational
Source: Microsoft-Windows-CAPI2
Date: 11/08/2011 09:39:23
Event ID: 41
Task Category: Verify Revocation
Level: Error
Keywords: Revocation,Path Validation
User: SYSTEM
Computer: ServerName.Domain
Description:
For more details for this event, please refer to the "Details" section
Event Xml:
Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event" System Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventID41
Version 0
Level 2
Task 41
Opcode 2
Keywords 0x8000000000000005
TimeCreated SystemTime="2011-08-11T0 9:39:23.671125000Z"
EventRecordID 19338 Execution ProcessID="656" ThreadID="776"
Channel Microsoft-Windows-CAPI2/Operational
Computer ServerName.Domain
Security UserID="S-1-5-18"
System
UserData
CertVerifyRevocation
Certificate fileRef="1727E2E531E2AD1FA810311A2E516172C1000141.cer" subjectName="ServerName.Domain"
IssuerCertificate fileRef="1727E2E531E2AD1FA810311A2E516172C1000141.cer" subjectName="ServerName.Domain"
Flags value="8" CERT_VERIFY_REV_SERVER_OCSP_FLAG="true"
AdditionalParameters timeToUse="2011-08-11T09:39:23.671Z" currentTime="2011-08-11T09:39:23.671Z" urlRetrievalTimeout="PT15S"
RevocationStatus index="0" error="80092014" reason="0"
EventAuxInfo ProcessName="lsass.exe"
CorrelationAuxInfo TaskId="{D3D11046-EC99-4A4B-8281-838294A811AF}" SeqNumber="3"
Result value="80092014">The certificate is not in the revocation server's database.

I have tried the microsoft way of removing all cached certs and rebooting the server, I also know that McAfee can create this issue also.

Anyone have any other ideas.

Thanks

Darren.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.