Share via

Event ID 27 — AD CS Certification Authority Certificate and Chain Validation

  • Article

Applies To: Windows Server 2008

Chain or path validation is the process by which end-entity (user or computer) certificates and all certification authority (CA) certificates are processed hierarchically until the certificate chain terminates at a trusted, self-signed certificate. Typically, this is a root CA certificate. Active Directory Certificate Services (AD CS) startup can fail if there are problems with availability, validity, and chain validation for the CA certificate.

Event Details

Product: Windows Operating System
ID: 27
Source: Microsoft-Windows-CertificationAuthority
Version: 6.0
Symbolic Name: MSG_E_INCOMPLETE_HIERARCHY
Message: Active Directory Certificate Services did not start: Hierarchical setup is incomplete. Use the request file in %1.req to obtain a certificate for this certification authority, and use the Certification Authority snap-in to install the new certificate and complete the installation.

Resolve

Complete installation by importing a newly issued CA certificate

A certification authority (CA) must have a valid CA certificate in order to function. If you do not already have a valid CA certificate, complete the installation by importing one.

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

To import a newly issued CA certificate and complete a CA installation:

  1. On the computer hosting the CA, click Start, point to Administrative Tools, and then click Certification Authority.
  2. Right-click the name of the CA, point to All Tasks, and click Start Service.
  3. Follow the prompts to complete installation by importing the newly issued CA certificate.

Verify

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

To confirm that the certification authority (CA) certificate and chain are valid:

  1. On the computer hosting the CA, click Start, type mmc, and then press ENTER.
  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  3. On the File menu, click Add/Remove Snap-in, click Certificates, and then click Add.
  4. Click Computer account, and click Next.
  5. Click Finish, and then click OK.
  6. In the console tree, click Certificates (Local Computer), and then click Personal.
  7. Confirm that a CA certificate that has not expired exists in this store.
  8. Right-click this certificate and select Export to launch the Certificate Export Wizard.
  9. Export the certificate to a file named Cert.cer.
  10. Type Start, cmd and press ENTER.
  11. Type certutil -urlfetch -verify <cert.cer> and press ENTER.
  12. If no validation, chain building, or revocation checking errors are reported, the chain is valid.

AD CS Certification Authority Certificate and Chain Validation

Active Directory Certificate Services