Troubleshooting Pki Configuration; Failed To Obtain The Ca Certificate; Failed To Obtain Local Certificates - HP FlexFabric 5700 Series Security Configuration Manual

To display detailed information about the CA certificate, use the display pki certificate domain
command.

Troubleshooting PKI configuration

This section provides troubleshooting information for common problems with PKI.

Failed to obtain the CA certificate

Symptom
The CA certificate cannot be obtained.
Analysis
The network connection is down, for example, because the network cable is damaged or the
•
connectors have bad contact.
No trusted CA is specified.
•
The certificate request URL is incorrect or not specified.
•
• The system time of the device is not synchronized with the CA server.
The source IP address of the PKI protocol packets is not specified or not correct.
•
The fingerprint of the root CA certificate is illegal.
•
Solution
1. Check for and fix any network connection problems.
2. Verify that the required configurations are correct.
3. Use ping to verify that the CA or RA is accessible from the specified certificate request URL.
4. Synchronize the system time of the device with the CA server.
5. Specify the correct source IP address for PKI protocol packets that the CA server can accept.
6. Verify the CA certificate's fingerprint on the CA server.
7. If the problem persists, contact HP Support.

Failed to obtain local certificates

Symptom
No local certificates can be obtained.
Analysis
The network connection is down.
•
No CA certificate has been obtained before you try to obtain local certificates.
•
90:65:45:4a:88:96:e4:88:bd:59:25:44:3f:61:c6:b1:08:5b:
86:d2:4f:61:4c:20:38:1c:f4:a1:0b:ea:65:87:7d:1c:22:be:
b6:17:17:8a:5a:0f:35:4c:b8:b3:73:03:03:63:b1:fc:c4:f5:
e9:6e:7c:11:e8:17:5a:fb:39:e7:33:93:5b:2b:54:72:57:72:
5e:78:d6:97:ef:b8:d8:6d:0c:05:28:ea:81:3a:06:a0:2e:c3:
79:05:cd:c3
245