Chapter 18: Baseline Privacy Interface (BPI)
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
591
Drop Invalid CA Certificates
The user may find through inspection of the CA Certificate MIB table, untrusted and/or invalid (bad) certificates.
Although these bad certificates are stored (by default) in accordance with the Baseline Privacy DOCSIS specification, there
is no adverse effect with leaving these bad certificates out of the CA Certificate MIB table. On the other hand, if there are a
large number of these bad certificates in the CA Certificate MIB table, their presence in the table can prevent valid
certificates from being put into the table, which can block good modems from completing BPI+ authentication properly.
Previously, to remove these deficient entries, a time consuming manual maintenance procedure needed to be performed.
In this case, using the "Drop Invalid CA Certificates" feature, the learning of bad CA certificate entries can be prevented
eliminating the necessity of customer maintenance.
Feature Objectives — When this feature is enabled:
The drop operation only works on learned CA certificates during the period of modem BPI+ initialization.
The drop operation only applies to newly learned certificates, not existing certificates already stored in the CA
Certificate MIB table.
The provisioning of valid, or bad certificates can still be performed manually.
Possible issues that can be alleviated by this feature are:
Modems stuck in a BPI init (some cases) identified in a log entry, as follows:
No certificates found to chain to CM certificate. CM Certificate invalid.
Greater than 100 entries in the CA Certificate MIB table identified in a log entry, as follows:
Cannot store CA Certificate, mib index overflow. Recover CA Certificate MIB entries.
If any of these conditions currently exist in the CA Certificate MIB table, this feature can be enabled and the bad
certificates can be removed ensuring no future recurrence.
MIB Object — The cadUpchannelCaCertDropEnable MIB object can prevent storage of newly learned bad CA certificates.
Setting this object to TRUE prevents/disables the storage of learned bad certificates in the CA Certificate MIB table. Setting
or leaving the value at the default setting of FALSE, allows the storage of learned bad certificates in the CA Certificate MIB
table.
When a bad certificate is prevented from entry in the CA Certificate MIB table, a notice-level event containing the MAC
address of the CM that provided the bad certificate is logged in a log entry similar to the following examples: