XADM: Key Management Server Cannot Grant V3 Certificates to Users with Long Distinguished Names

Article translations Article translations
Article ID: 247814 - View products that this article applies to.
This article was previously published under Q247814
Expand all | Collapse all

SYMPTOMS

When using Key Management (KM) Server and Certificate Server to issue V3 certificates, some mailboxes may not be able to obtain a certificate. After submitting a security token from Microsoft Outlook, the following error message is returned:
The message from the Microsoft Exchange Key Management Server could not be processed. Contact your administrator for a new security token, and set up advanced security again.
Additionally, an event similar to the following is logged in the application log of the Exchange Server computer:
Event ID: 5005
Source: MSExchangeKMS
Description: Mailbox "o=Orgname, ou=Sitename, cn=Recipients, cn=Subcontainer1, cn=Subcontainer2, cn=Subcontainer3, cn=Mailbox" has failed being enabled or recovered.

CAUSE

Certificate Server 1.0 enforces a 64-character limit on the Subject of a certificate. The Subject is a concatenation of each Relative Distinguished Name (RDN) within the Distinguished Name (DN). In the example above, the DN is "o=Orgname, ou=Sitename, cn=Recipients, cn=Subcontainer1, cn=Subcontainer2, cn=Subcontainer3, cn=Mailbox". The limit is placed on the concatenation of "Orgname, Sitename, Recipients, Subcontainer1, Subcontainer2, Subcontainer3, Mailbox", which is (7 + 8 + 10 + 13 + 13 + 13 + 7). This exceeds the 64-character limit, and therefore Certificate Server cannot generate a certificate for this mailbox.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Properties

Article ID: 247814 - Last Review: October 27, 2006 - Revision: 3.2
APPLIES TO
  • Microsoft Certificate Server 1.0
  • Microsoft Exchange Server 5.5 Standard Edition
Keywords: 
kbprb KB247814
Retired KB Content Disclaimer
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com