Failed To Obtain Crls; Failed To Import The Ca Certificate - HP VSR1000 Security Configuration Manual

Failed to obtain CRLs

Symptom
CRLs cannot be obtained.
Analysis
The network connection is down because, for example, the network cable is damaged or the
•
connectors have bad contact.
No CA certificate has been obtained before you try to obtain CRLs.
•
The URL of the CRL repository is not configured, and the proper URL cannot be obtained from the
•
CA certificate or local certificates in the PKI domain.
The specified URL of the CRL repository is incorrect.
•
• The device tries to obtain CRLs through SCEP, but the PKI domain does not have local certificates,
or the key pairs in the certificates have been changed or the PKI domain has incorrect URL for
certificate request.
The specified URL of the CRL repository contains incomplete address (for example, no host name or
•
IP address exists) and the LDAP server configuration does not exist or is incorrect in the PKI domain.
The CA does not issue CRLs.
•
The PKI domain is not specified with the source IP address of the PKI protocol packets that the CA
•
server can accept, or is specified with an incorrect one.
Solution
1. Make sure the network connection is physically proper.
2. Obtain or import the CA certificate.
3. If the URL of the CRL repository cannot be obtained, configure correct URL for certificate request,
and obtain the local certificate successfully. The public key in the certificate must match the public
key in the local key pair.
4. Make sure the URL of the CRL repository contains the complete address, or the PKI domain is
specified with the correct LDAP server.
5. The CA issues the CRLs.
6. Specify the correct source IP address for PKI protocol packets that the CA server can accept. For
the correct settings, contact the CA server administrator.

Failed to import the CA certificate

Symptom
The CA certificate cannot be imported.
Analysis
• CRL checking is enabled, but CRLs do not exist locally or CRLs cannot be obtained.
The specified format does not match the actual format of the imported file.
•
Solution
1. Use undo crl check enable to disable CRL checking.
2. Make sure the format of the imported file is proper.
167