Troubleshooting certificate management problems with AD FS 2.0

Updated: May 5, 2010

Applies To: Active Directory Federation Services (AD FS) 2.0

The following table provides troubleshooting guidance for specific error event messages or other issues that you may encounter if you are having problems with managing certificates.

Before you begin the troubleshooting process, we recommend that you first try to configure Active Directory Federation Services (AD FS) 2.0 for troubleshooting and check for known common issues that might prevent normal functioning for the Federation Service. For detailed instructions for configuring and performing related system checks, see Configuring Computers for Troubleshooting AD FS 2.0 and Things to Check Before Troubleshooting AD FS 2.0.

Event or symptom	Possible cause	Resolution
Event ID 329 The certificate could not be decrypted by using the keys for X.509 certificate private key sharing.	The following are possible causes for this event: Active Directory objects are missing under the specified distinguished name in the diagnostic information regarding X.509 certificate private key sharing that is provided in this event. The access control list (ACL) permissions of the Active Directory objects that are specified in the diagnostic information have changed, and the service identity of AD FS no longer has rights to read or modify those objects.	The following are possible resolutions for this event: You may have to restore all Active Directory objects under the distinguished name that was specified in the event-included diagnostic information. Work with your domain administrator to help restore read/write ACL permissions.
Event ID 331 The certificate management service encountered an error during decryption of the keys.	The following are possible causes for this event: Active Directory objects are missing under the specified distinguished name in the diagnostic information regarding X.509 certificate private key sharing that is provided in this event. The ACL permissions of the Active Directory objects that are specified in the diagnostic information have changed, and the service identity of AD FS no longer has rights to read or modify those objects.	The following are possible resolutions for this event: You may have to restore all Active Directory objects under the distinguished name that was specified in the event-included diagnostic information. Work with your domain administrator to help restore read/write ACL permissions.
Event ID 332 The certificate management service encountered an error during encryption of the keys.	The following are possible causes for this event: Active Directory objects are missing under the specified distinguished name in the diagnostic information regarding X.509 certificate private key sharing that is provided in this event. The ACL permissions of the Active Directory objects that are specified in the diagnostic information have changed, and the service identity of AD FS no longer has rights to read or modify those objects.	The following are possible resolutions for this event: You may have to restore all Active Directory objects under the distinguished name that was specified in the event-included diagnostic information. Work with your domain administrator to help restore read/write ACL permissions.
Event ID 333 The certificate management service encountered an error during database access.	The SQL Server database is possibly offline.	Confirm that the SQL store is online. Also, the Windows Event log should contain other SQL-related service events that will have more detailed information if this event occurs. Use those events to help further troubleshoot database access.
Event ID 334 Certificate rollover service must roll over certificates urgently. Partners cannot apply the update in time.	The certificate rollover service forced an urgent rollover of certificates.	Partners must apply the certificate rollover update manually to be in time.
Event ID 338 An error was encountered during certificate rollover. The monitoring cycle was shut down.	Any error in the certificate rollover service task can cause this event to occur. If this event occurs, a preceding error in the AD FS 2.0 event log contains the actual cause for this error.	Manually check to determine whether any certificates are nearing expiration. If certificates are not nearing expiration, no further action is required. If certificates are near to expiration, restart the AD FS 2.0 Windows service to restart the certificate rollover process.