I've migrated my Active Directory Certificate services Enterprise CA to a new server (and from Windows 2003 R2 x86 to Windows 2008 R2 x64).
I have been having problems with checking the Certificate Revocation Lists, but I've republished the revocation lists from the Root CA and when I run certutil -urlfetch -verify I don't get any errors:
------------------------------------ Verified Issuance Policies: None Verified Application Policies: All Cert is a CA certificate Leaf certificate revocation check passed CertUtil: -verify command completed successfully.
But I still get the same errors when I try to start the CA. I get the following pop-up:
--------------------------- Microsoft Active Directory Certificate Services --------------------------- The system cannot find the file specified. 0x2 (WIN32: 2) The policy module for a CA is missing or incorrectly registered. To view or change policy module settings, right-click on the CA, click Properties, and then click the Policy Module tab. --------------------------- OK ---------------------------
and I get the following error in the log:
Log Name: Application
Source: Microsoft-Windows-CertificationAuthority
Date: 26/06/2012 15:59:45
Event ID: 100
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: SRV112.cobbsch.cobbetts.co.uk
Description:
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. Cobbetts LLP Enterprise CA The system cannot find the file specified. 0x80070002 (WIN32: 2).
Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-CertificationAuthority" Guid="{6A71D062-9AFE-4F35-AD08-52134F85DFB9}" EventSourceName="CertSvc" /><EventID Qualifiers="49754">100</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2012-06-26T14:59:45.000000000Z" /><EventRecordID>852</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>Application</Channel><Computer>SRV112.cobbsch.cobbetts.co.uk</Computer><Security UserID="S-1-5-18" /></System><EventData Name="MSG_E_CA_CERT_INVALID"><Data Name="CACommonName">Cobbetts LLP Enterprise CA</Data><Data Name="ErrorCode">The system cannot find the file specified. 0x80070002 (WIN32: 2)</Data></EventData></Event>I've tried rebooting the machine to see if there was some sort of cached failure that I needed to clear, and that's not made any difference.
I wondered if the SYSTEM account (which the service is running under) was lacking some permission that my domain admin account (which is the account that I'm running certutil under) has, but I've just run certutil from a SYSTEM command prompt (ie one launched with psexec -i -s cmd.exe) and I still get "CertUtil: verify command completed successfully."