Novell Enhanced Smart Card Method 3.0.1, Installation Manual

Page: 39 / 46

Troubleshooting 39
no
vd
ocx
(e
n)
6 Ap
ril 20
07
6.3.2 Certificate Validation Issues
If the method fails with an Invalid Certificate or Certificate Validation Failed message, the method
was unable to validate the certificate sent by the workstation. Check the following items:
Š
The certificate on the smart card is not expired or has not been revoked by the issuing
Certificate Authority.
Š
The method is properly configured with a trusted root container that contains a valid trusted
root certificate. See
Section 5.2, “Configuring Trusted Root Certificates,” on page 29 for
information about configuring the trusted root container.
Š
Certificate revocation checking is properly configured. See Section 5.3, “Configuring
Certificate Revocation Checking,” on page 31 for more information.
Š
CRL and OCSP revocation checking requires connectivity to the CRL Distribution Point or
OCSP Responder. If the information is unavailable, the validation process fails.
When using OCSP validation, the OCSP response is signed by the responder's certificate. In
order for the response to be considered valid, the responder's certificate must be trusted. Place
the OCSP responder's trusted root certificate in the trusted root container to identify it as
trusted.