Windows Event ID 5378 – SCHANNEL: TLS/SSL Certificate Chain Validation Error

Start by examining the complete event details to identify the specific certificate and error code:

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 5378 using the filter option
3. Double-click the most recent 5378 event to view details
4. Note the certificate thumbprint and error description in the event data
5. Use PowerShell to retrieve detailed certificate information:

# Get certificate details by thumbprint
$thumbprint = "PASTE_THUMBPRINT_HERE"
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq $thumbprint} | Format-List *

# Check all certificate stores for the certificate
Get-ChildItem -Path Cert:\LocalMachine -Recurse | Where-Object {$_.Thumbprint -eq $thumbprint}

Review the certificate's validity period, issuer information, and intended purposes. This initial analysis helps determine whether the issue is certificate expiration, missing trust, or chain problems.

Validate the complete certificate chain and ensure all required certificates are present:

1. Use PowerShell to test certificate chain building:

# Test certificate chain for a specific server
$serverName = "your-server.domain.com"
$port = 443

# Create TCP connection and retrieve certificate
$tcpClient = New-Object System.Net.Sockets.TcpClient
$tcpClient.Connect($serverName, $port)
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream())
$sslStream.AuthenticateAsClient($serverName)
$cert = $sslStream.RemoteCertificate
$sslStream.Close()
$tcpClient.Close()

# Display certificate chain
$cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($cert)
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($cert2)
$chain.ChainElements | ForEach-Object { $_.Certificate | Format-List Subject, Issuer, NotAfter }

2. Check trusted root certificate authorities:

# List trusted root CAs
Get-ChildItem -Path Cert:\LocalMachine\Root | Format-Table Subject, Thumbprint, NotAfter

# Check for specific root CA
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Subject -like "*YourCA*"}

3. Verify intermediate certificates are installed:

# Check intermediate certificate store
Get-ChildItem -Path Cert:\LocalMachine\CA | Format-Table Subject, Issuer, NotAfter

Install missing root or intermediate certificates to complete the trust chain:

1. Download the required root certificate from your certificate authority
2. Install root certificate using PowerShell:

# Install root certificate
$certPath = "C:\path\to\rootca.cer"
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath)
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

Write-Host "Root certificate installed successfully"

3. Install intermediate certificates:

# Install intermediate certificate
$intermediatePath = "C:\path\to\intermediate.cer"
$intermediateCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($intermediatePath)
$intermediateStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("CA", "LocalMachine")
$intermediateStore.Open("ReadWrite")
$intermediateStore.Add($intermediateCert)
$intermediateStore.Close()

4. Update certificate revocation lists:

# Force CRL update
certlm.msc
# Navigate to Intermediate Certification Authorities → Certificates
# Right-click certificate → All Tasks → Update Certificate Revocation List

5. Test the connection after certificate installation to verify the fix

Modify certificate validation behavior through registry settings and group policy:

1. Configure certificate validation registry settings:

# Disable certificate revocation checking (temporary troubleshooting only)
$regPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config"
New-ItemProperty -Path $regPath -Name "MaxUrlRetrievalTimeoutMilliseconds" -Value 15000 -PropertyType DWord -Force
New-ItemProperty -Path $regPath -Name "MaxUrlRetrievalByteCount" -Value 100000000 -PropertyType DWord -Force

2. Configure SCHANNEL logging for detailed troubleshooting:

# Enable SCHANNEL event logging
$schannelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL"
New-ItemProperty -Path $schannelPath -Name "EventLogging" -Value 7 -PropertyType DWord -Force

3. Set certificate chain policy through registry:

# Configure certificate chain policy
$chainPath = "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config"
if (!(Test-Path $chainPath)) { New-Item -Path $chainPath -Force }
New-ItemProperty -Path $chainPath -Name "MaxUrlRetrievalTimeoutMilliseconds" -Value 30000 -PropertyType DWord -Force

4. Restart affected services to apply changes:

# Restart HTTP service and dependent services
Restart-Service -Name "HTTP" -Force
Restart-Service -Name "W3SVC" -Force -ErrorAction SilentlyContinue

Perform comprehensive certificate chain analysis and network-level troubleshooting:

1. Use OpenSSL tools for detailed certificate analysis:

# Download and analyze certificate chain using PowerShell
$serverName = "problematic-server.com"
$port = 443

# Create detailed certificate chain report
$webRequest = [Net.WebRequest]::Create("https://$serverName")
try {
    $webRequest.GetResponse()
} catch {
    $exception = $_.Exception
    if ($exception.InnerException -is [System.Security.Authentication.AuthenticationException]) {
        Write-Host "Certificate validation failed: $($exception.InnerException.Message)"
    }
}

2. Analyze certificate revocation list accessibility:

# Test CRL and OCSP endpoint accessibility
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*your-cert*"}
$cert.Extensions | Where-Object {$_.Oid.FriendlyName -eq "CRL Distribution Points"} | ForEach-Object {
    $_.Format($true)
}

# Test OCSP responder
$cert.Extensions | Where-Object {$_.Oid.FriendlyName -eq "Authority Information Access"} | ForEach-Object {
    $_.Format($true)
}

3. Monitor certificate validation in real-time:

# Monitor SCHANNEL events in real-time
Get-WinEvent -FilterHashtable @{LogName='System'; Id=5378} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

# Set up continuous monitoring
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='System' AND EventCode=5378" -Action {
    $event = $Event.SourceEventArgs.NewEvent
    Write-Host "Certificate validation error detected at $($event.TimeGenerated)"
    Write-Host "Message: $($event.Message)"
}

4. Create comprehensive certificate validation report:

# Generate certificate validation report
$report = @()
Get-ChildItem -Path Cert:\LocalMachine\My | ForEach-Object {
    $cert = $_
    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
    $isValid = $chain.Build($cert)
    
    $report += [PSCustomObject]@{
        Subject = $cert.Subject
        Thumbprint = $cert.Thumbprint
        NotAfter = $cert.NotAfter
        IsValid = $isValid
        ChainStatus = ($chain.ChainStatus | ForEach-Object { $_.Status }) -join ", "
    }
}
$report | Export-Csv -Path "C:\temp\certificate-validation-report.csv" -NoTypeInformation