Share via

Event ID 87 — AD CS Key Archival and Recovery

  • Article

Applies To: Windows Server 2008

Active Directory Certificate Services (AD CS) requires key recovery agent certificates, exchange (XCHG) certificates, and keys in order to support key archival. The functioning of key recovery agent certificates, XCHG certificates, and the cryptographic service providers (CSPs) needed to create them is critical to a public key infrastructure.

Event Details

Product: Windows Operating System
ID: 87
Source: Microsoft-Windows-CertificationAuthority
Version: 6.0
Symbolic Name: MSG_E_BAD_DEFAULT_CA_XCHG_CSP
Message: Active Directory Certificate Services could not use the default provider for encryption keys. %1

Resolve

Use a cryptographic service provider that supports key archival and recovery

It may not be possible to use administrative tools to resolve problems that are caused by cryptographic providers, the software component that performs encryption and related tasks for encryption certificate generation. However, the following tasks can reveal diagnostic information to assist in the resolution process:

  • Identify and test your cryptographic provider.
  • If you continue to have problems and are using a non-Microsoft provider, contact the vendor for troubleshooting information. 
  • You can also reset to the default encryption key provider, but you will also have to revoke the current CA Exchange certificate so that a new one based on the new provider is issued.
  • If you continue to have problems and are using a Microsoft provider, then contact Microsoft Customer Service and Support.  

Identify and test a cryptographic provider

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

To identify and test the cryptographic provider you are using:

  1. Open a command prompt window.
  2. Type certutil -getreg ca\EncryptionCSP and press ENTER.
  3. Type certutil -csp <providername> -csptest and press ENTER. Replace providername with the provider identified in the output of step 2.
  4. If you are using a non-Microsoft cryptographic provider, contact the vendor for help. Otherwise, contact Microsoft Customer Service and Support.

Reset the default encryption key provider

To perform this procedure, you must have membership in local Administrators, or you must have been delegated the appropriate authority.

You can configure the certification authority (CA) to use the default Microsoft provider for encryption certificates by setting the following registry key to Microsoft Software Key Storage Provider.

Note: You may have to revoke the current CA Exchange certificate, if there is one, so that a new one based on the new provider is issued. Then, restart the CA.

To modify a configured encryption key provider:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

  1. On the computer hosting the CA, click Start, type regedit, and then press ENTER.
  2. Go to HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\CA Name\EncryptionCSP\Provider.
  3. Change the listed value to Microsoft Software Key Storage Provider.
  4. Open the Certification Authority snap-in.
  5. In the console tree, click Issued Certificates.
  6. In the details pane, select the CA Exchange certificate.
  7. On the Action menu, point to All Tasks, and click Revoke Certificate.
  8. Select the reason for revoking the certificate, adjust the time of the revocation, if necessary, and then click Yes.
  9. Restart the CA.

Verify

To perform this procedure, you must have Manage CA permission, or you must have been delegated the appropriate authority.

To confirm that key archival and recovery is working properly:

  1. On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.
  2. In the console tree, right-click the name of the certification authority (CA), and then click Properties.
  3. Click the Recovery Agents tab.
  4. Confirm that all key recovery agent certificates are listed as Valid.
  5. In the Certificate Templates container, confirm that an encryption certificate has the option Archive subject's encryption private key configured on the Request Handling tab.
  6. Open the Certificates snap-in for a user account that has permissions to enroll for a certificate based on this certificate template.
  7. In the console tree, right-click Personal, point to All Tasks, and click Request New Certificate to start the Certificate Enrollment wizard.
  8. Enroll for a certificate based on the encryption template, and confirm that the enrollment completes successfully and no errors are reported.
  9. When the enrollment is complete, open the Certification Authority snap-in.
  10. In the console tree, click Issued Certificates.
  11. Locate the entry for the certificate that was just issued, and add the Archived Key column to the snap-in display list.
  12. Confirm that the word Yes appears in the Archived Key column for the certificate that was just issued.

AD CS Key Archival and Recovery

Active Directory Certificate Services