247
Solution
1.
Check for and fix any network connection problemes.
2.
Obtain or import the CA certificate.
3.
Use
ping
to verify that the CA or RA is accessible from the specified certificate request URL.
4.
Specify the correct certificate request URL.
5.
Check the registration policy on the CR/RA, and make sure the attributes of the PKI entity meet the
policy requirements.
6.
Specify the key pair used for certificate request in the PKI domain, or remove the key pair specified
in the PKI and submit a certificate request again.
7.
Use
pki abort-certificate-request domain
to abort the certificate request.
8.
Specify the correct source IP address that the CA server can accept. For the correct settings,
contact the CA administrator.
9.
Synchronize the system time of the device with the CA server.
10.
If the problem persists, contact HP Support.
Failed to obtain CRLs
Symptom
CRLs cannot be obtained.
Analysis
•
The network connection is down, for example, because the network cable is damaged or the
connectors have bad contact.
•
No CA certificate has been obtained before you try to obtain CRLs.
•
The URL of the CRL repository is not configured and cannot be obtained from the CA certificate or
local certificates in the PKI domain.
•
The specified URL of the CRL repository is incorrect.
•
The device tries to obtain CRLs through SCEP, but experiences the following problems:
{
The PKI domain does not have local certificates.
{
The key pairs in the certificates have been changed.
{
The PKI domain has incorrect URL for certificate request.
•
The specified URL of the CRL repository does not contain the host name or IP address, and the LDAP
server is incorrect or is not specified in the PKI domain.
•
The CA does not issue CRLs.
•
The PKI domain is not specified with the source IP address that the CA server can accept, or is
specified with an incorrect one.
Solution
1.
Check for and fix any network connection problems.
2.
Obtain or import the CA certificate.
3.
If the URL of the CRL repository cannot be obtained, verify that the following conditions exist:
{
The URL for certificate request is valid.
{
A local certificate has been successfully obtained.
