I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to generate TLS certificates for IIS web servers.
I'm using NIST 800-57/NIST 800-52 as standards against which to base this process document. When it comes to the
Destroyed State for the private key, I want to document how an auditor can check and verify that a revoked certificate's private key has been "destroyed" (or deleted) based on Windows/IIS) event or security logs.
I have no clue where to find such an event or security log. Can anyone point me in the right direction?
Short version: How might an auditor validate that a web server's SSL/TLS Certifiate's corresponding private key has been deleted from a Windows IIS security/audit logs?