Microsoft-Windows-IIS-CentralCertificateProvider

Event	Title	Channel	Sample	Rule
101	task_0	Operational	N	N
102	task_0102	Administrative	N	N
103	task_0103	Operational	N	N
104	task_0104	Operational	N	N
105	task_0105	Operational	N	N
106	task_0106	Operational	N	N
107	task_0107	Operational	N	N
108	task_0108	Operational	N	N
109	task_0109	Operational	N	N
110	task_0110	Operational	N	N
111	task_0111	Administrative	N	N
112	task_0112	Administrative	N	N

Event ID 101: task_0

Channel: Operational

Message #

Provider initialization was successful.

Event ID 102: task_0102

Channel: Administrative

Message #

Provider initialization failed. HRESULT [%1]

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 103: task_0103

Channel: Operational

Message #

Provider successfully served PFX [%1] for DNS [%2].

Fields #

Name	Description
`PfxFilePath` UnicodeString
`DNSNameBlob` UnicodeString
`HRESULT` HexInt32

Event ID 104: task_0104

Channel: Operational

Message #

Provider failed to serve PFX [%1] for DNS [%2]. HRESULT [%3]

Fields #

Name	Description
`PfxFilePath` UnicodeString
`DNSNameBlob` UnicodeString
`HRESULT` HexInt32

Event ID 105: task_0105

Channel: Operational

Message #

Provider was requested to free the PFX blob.

Event ID 106: task_0106

Channel: Operational

Message #

Provider was requested to free the PFX identifier [%1].

Fields #

Name	Description
`PfxIdentifier` UnicodeString

Event ID 107: task_0107

Channel: Operational

Message #

Provider was requested to free the PFX decryption password.

Event ID 108: task_0108

Channel: Operational

Message #

Provider was requested to release resources. Reason Reason Code [%1], description [%2]

Fields #

Name	Description
`Reason` UInt32
`ReasonDesc` UnicodeString

Event ID 109: task_0109

Channel: Operational

Message #

Provider provided a host process with a list of cache entries to flush. The procedure was successful.

Event ID 110: task_0110

Channel: Operational

Message #

Provider provided a host process with a list of cache entries to flush. The procedure failed.

Event ID 111: task_0111

Channel: Administrative

Message #

Provider successfully updated configuration from registry key [HKLM\SOFTWARE\Microsoft\IIS\CentralCertProvider] change.

Event ID 112: task_0112

Channel: Administrative

Message #

Provider failed to update configuration from registry key [HKLM\SOFTWARE\Microsoft\IIS\CentralCertProvider] change. HRESULT [%1]

Fields #

Name	Description
`HRESULT` HexInt32

Provenance

ETW provider GUID ab1d279a-75cc-4f2a-8fea-38e61f54d048

Defined in iiscertprovider.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB