Agents DSCC certificates

Similar Questions

• How can I change the password for Agent DSCC on ODSEE 11.1.1.7?

  Hello

  Someone at - he met how to change the password for the DSCC Agent? I found not yet all orders that allows it.

  Mohammad

  Hello

  Sylvain, the links you give are not 11.1.1.7 for previous versions.

  There is no CLI to change the password of DSCC agent in 11.1.1.7. As agent DSCC has no data, I suggest to delete and recreate your agent by using the following path:

  • dsccreg remove-agent
  • dsccagent delete
  • create a dsccagent (use the same port as before)
  • dsccreg add agent

  No change on the servers of DS/DPS is necessary (no new registration...), if you keep the same port.

  It will be useful,

  Carole

• "dsccreg add-server" translates to "DSCC Agent not found"

  Hello

  I have set up two servers, 'ldap1' and 'ldap2', the two 7-Department (11.1.1.7.0) running with DSCC configured on ldap1.  On ldap1, the DSCC agent runs:

  root@ldap1:~#/opt/dsee7/bin/dsccagent info - v

  The instance path: / opt/dsee7/var/dcc/agent

  Owner: root

  JMX port: 3997

  SNMP port: disabled

  Status: running

  PID: 25898

  DSCC hostname: ldap1.utica.edu

  Port not secure from DSCC: 3998

  Port secure DSCC: 3999

  The instance version: A - A00

  I was able to save its own DS to DSCC instance by running the following:

  root@ldap1:~#/opt/dsee7/bin/dsccreg server add - v h ldap1.utica.edu h ldap1.utica.edu d ldap1-dsins1/var/opt/dsee7/dsins1

  Enter the password of the administrator DSCC:

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  / var/opt/dsee7/dsins1 is an instance of DS

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  Agent no. Hostname Port owner iPath

  --------  ---------------  ----  -----  ------------------------

  0 ldap1.utica.edu 3997 root/opt/dsee7/var/dcc/agent

  The recording will be use DSCC agent on port: 3997

  Enter the password of "cn" = Directory Manager for/var/opt/dsee7/dsins1:

  This operation will restart/var/opt/dsee7/dsins1.

  Do you want to continue? y (y/n)

  Connection to/var/opt/dsee7/dsins1 (via ldap://127.0.0.1:389)

  Allowing the DSCC access to/var/opt/dsee7/dsins1

  / Var/opt/dsee7/dsins1 restart

  Registration/var/opt/dsee7/dsins1 to DSCC on ldap1.utica.edu.

  You are looking for an entry "cn=ldap1.utica.edu@/var/opt/dsee7/dsins1,cn=Servers,cn=dscc".

  However, when I try to register the instance of DS on ldap2 with the DSCC instance on ldap1, I get the following:

  root@ldap2:~#/opt/dsee7/bin/dsccreg server add - v h ldap2.utica.edu h ldap1.utica.edu d ldap2-dsins1/var/opt/dsee7/dsins1

  Enter the password of the administrator DSCC:

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  / var/opt/dsee7/dsins1 is an instance of DS

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  No agent DSCC found

  / var/opt/dsee7/dsins1 has not been saved to the DSCC on ldap1.

  Running on ldap1 tcpdump showed that connected to ldap1 on port 3998 ldap2 and there were 51 packets exchanged between these two hosts before ldap2 showed the mistake found no. DSCC agent and abandoned the attempt.  So at least I know that it is not a network problem.  I restarted the DSCC agent on ldap1 several times, but he has not made a difference.

  Anyone know what could be the problem?

  I finally solved the problem.  I needed to create a DSCC agent on the 2nd Department (ldap2) server and point it at the DSCC (ldap1) host:

  root@ldap2:~#/opt/dsee7/bin/dsccreg add-agent - v h ldap1.utica.edu/opt/dsee7/var/dcc/agent

  HostName: ldap2.utica.edu

  Agent path: / opt/dsee7/var/dcc/agent

  Enter DSCC agent "/ opt/dsee7/var/DCC/agent" password:

  Download the config file

  Representative is not already registered; check the password for agent instance

  Password agent instance OK

  Enter the password of the administrator DSCC:

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  Try to register the agent:

  Agent port: 3997

  Agent user name: root

  Host name: ldap2.utica.edu

  Instance of agent registered in DSCC; update the agent config file

  Update configuration file:

  Agent/opt/dsee7/var/dcc/agent configuration file updated with:

  Host name of registry = ldap1.utica.edu

  Port of registry = 3998

  Secure registry 3999 = port

  Agent instance was recorded at the DSCC ldap1.utica.edu

  You can now run dsccagent start to start the agent

  root@ldap2:~#/opt/dsee7/bin/dsccagent start

  The/opt/dsee7/var/dcc/agent agent started

  Once this is done, the DSCC registration worked well:

  root@ldap2:~#/opt/dsee7/bin/dsccreg server add - v h ldap2.utica.edu h ldap1.utica.edu d ldap2-dsins1/var/opt/dsee7/dsins1

  Enter the password of the administrator DSCC:

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  / var/opt/dsee7/dsins1 is an instance of DS

  DSCC administrator password is OK

  Creation of trust cert

  Create the KeyStore file OK; try to connect...

  Agent no. Hostname Port owner iPath

  --------  ---------------  ----  -----  ------------------------

  0 ldap2.utica.edu 3997 root/opt/dsee7/var/dcc/agent

  The recording will be use DSCC agent on port: 3997

  Enter the password of "cn" = Directory Manager for/var/opt/dsee7/dsins1:

  This operation will restart/var/opt/dsee7/dsins1.

  Do you want to continue? y (y/n)

  Connection to/var/opt/dsee7/dsins1 (via ldap://127.0.0.1:389)

  Allowing the DSCC access to/var/opt/dsee7/dsins1

  / Var/opt/dsee7/dsins1 restart

  Registration/var/opt/dsee7/dsins1 to DSCC on ldap1.utica.edu.

  You are looking for an entry "cn=ldap2.utica.edu@/var/opt/dsee7/dsins1,cn=Servers,cn=dscc".

• Confilct port agent even after the removal of the agent in ODSEE11.1.1.7

  Hi all

  I am facing port 3997 DSCC agent conflicts when trying to register the agent host DSCC after removing the former agent with any errors.

  --------------------------------------------------------------------------

  Port (3997) is already used by
  [(old)chemin_installation/var/dcc/agent] on this host name
  (xxxx1).
  
  If [(new) chemin_installation/var/dcc/agent] has not been saved to DSCC
  on xxxx1.

  ------------------------------------------------------------------------------

  Measures have been taken to remove the agent:

  Unregister Server
  $ dsccreg remove-server - h host dscc - dscc-registry-port/local/dsInst p

  Remove the server instance.
  $ dsadm remove/local/dsInst

  Cancel and delete the DSCC Agent directory server
  stop dsccagent $
  $ dsccreg remove-agent dscc-home - p h dscc-registry-port
  $ dsccagent remove

  and I have faced problem when I try to register the agent again.

  I missed something?

  Thanks in advance.

  Try

  $ dsccreg remove-agent - force...

  HTH

• certificate of Agent of 12 c always on display in the SGD

  The SGC security console always show the agent certificate, even if the agent has been removed from the console using emcli delete_target.

  Now I want to reinstall the agent, and I fear that who will use the old certificate of agent for ssl communications.

  Is there a way to delete the certificate of the officer of the SGC security console.

  Thank you

  Hello

  Apparently, there's still a few entries of agent in rest of DB

  I recommend you open a SR with Oracle Support with the following information

  + Download the screenshot of the SGC security console showing the former agent certificate

  + Output of the OMS_HOME/bin

  /emcli get_ca_info-details

  + Download the latest version of emdiag using Doc 1426973.1EMDIAG REPVFY Kit for control of cloud 12 c - download, installation/disable-install and upgrade

  + Once so please run following command

  $ repvfy check - level 9 - retail

  + Zip and download files from $EMDIAG_HOME/log

  Kind regards

  Rahul

• HPDM: HPDM replace self signed SSL certificates for server HDPM and master repository

  I am trying to replace the automatically generated self-signed certificates (issued to DM) issued by DM server HDPM and master repository.  I'm NOT arbitration FTPS, HTTPS embedded HPDM or CERT Thin Client Agent server.

  I already have CERT for the installation of our own internal domain CA for FTPS in IIS and the built-in Apache HTTPS server.  These work properly and pass tests of repository for both protocols.  I also have questions for Thin Clients of our internal CA very well.

  I am interested in the HPDM real server cert and cert master repository. These are generated automatically when the two services start.  They use a very weak MD5 hash and key RSA 1024.  I can't find any documentation around that, with the exception of troubleshooting, in which you can remove these certificates restart services and they will be regenerated.

  Here are the paths certs\key
  HPDM % install Path%\MasterRepositoryController\Controller.crt (Cert repository)

  HPDM % install Path%\MasterRepositoryController\Controller.key (repository key)

  HPDM % install Path%\MasterRepositoryController\Client.crt (HPDM Server Cert)

  HPDM % install Path%\Server\Bin\hpdmskey.keystore (Both HPDM server and repository Certs and keys) (not sure what format it is in.  It is not PEM and P12 ok I can say)

  There are also some HPDM % install Path%\Server\bin\hpdmcert.key.  Don't know what it is.  It's the key to the server HPDM but deleting it does nothing and it is never re auto generated in one of my tests.

  I am able to replace the Controller.crt and keys with my own files CA internal those emitted very well.  The service started and no errors occur.  However if I replace the Client.cert (HPDM Server Cert) with my own service will start but there are Socket SSL errors in repository logs and the HPDM server could not connect to the master repository. I have no idea where the key file is supposed to be for HPDM Server Cert.

  Can anyone help with this?  I can't find the configuration files for the service to generate their own certificates.  If I did I would try at least to change the config to do not use MD5.

  Hello

  These certiricates between HPDM server and MRC are not designed for customizable. Please submite one scenario if you have concerns of security on it.

  Just for info:

  hpdmcert. Key is for communication between the server HPDM and gateway HPDM

  hpdmskey.keystore is for communication between the server HPDM and MRC

  server_keystore is for the commhucation between HPDM server and the Console HPDM

• To access the EFS data from another disk using original certificates/keys

  I use EFS on a Workgroup XP - Pro, SP3 and have backed up keys.  I am trying to access the files on this disk now mounted in another machine (also SP3 of XP - Pro and in a working group).  I can load the certificates of the first machine in the second machine by double clicking it.  Once the certificates are loaded, how decipher you?  I get "Access denied" when I right click and try to decrypt the files on the original drive.  The MS help talk about designating a "File Recovery Agent", but this procedure seems to be to area of machines and gets a bit fuzzy for working groups.  BTW, I'm testing my file recovery process.  No data is at risk.  Can you tell me FAQ to decrypt a file on a disk that is moved to another machine using the original (REC & PFX files) encryption certificates/keys?

  Hello Stephen,

  The question you posted would be better suited for COMPUTING public Pro on TechNet. I would recommend posting your query in the TechNet Forums to get help:

  Windows XP TechNet forums

• Is there a way to recover the EFS encrypted files stored on an external drive without the origianl certificate?

  Is there a way to recover the EFS encrypted files stored on an external drive without the original of the certificate?

  I had photos/files stored on an external drive and have been encrypted with EFS in XP. The main drive crashed, all keys have been lost. Got a new main drive, installed the new OS and now can't access encrypted files.

  Unless you can retrieve parts of your old drive or have a backup of your encryption certificate, you have probably lost all of your encrypted data.  Recovery agents work only if they are in place when the file/folder is initially encrypted.  A program like AEFSDR might be able to resurrect your old certificate from your old drive if it is readable at all.  If you plan to use EFS in the future, make sure you read the following article the court - particularly paragraph entitled "why you should back up your certificates.

  "Best practices for EFS file system.
    <>http://support.Microsoft.com/kb/223316 >

  HTH,
  JW

• How to upgrade the already encrypted files on the USB HDD with new XP Recovery certificate

  I backed up the files encrypted in My Documents on a USB drive on which these files are also encrypted state. My computer crashed so I reinstalled the operating system. I wanted to send records encrypted USB HD to my computer or tried to copy projecteurDu and paste them into My Documents. I could not do this because I got "an error occurred in the application...". access privilegesDo i., access is denied. "I created a new recovery certificate and put in place a recovery agent. From there how I update the previously encrypted files on th USB HDD with the new recovery certificate? I'd appreciate a step by step procedure. Can I select the USB drive in the command line and run cipher/u on this drive or make the command/u of encryption on the computer without connecting to the USB HDD

  Sorry to say that my bet is that you never gain access to these files again.

  When you created the files encrypted, Windows creates a key for decryption to access these files and stored, encrypted in your certificate store.  When your system crashed, the decryption key has crashed with it.  Without this key, you will never have access to your encrypted files.  If you have recovered from a backup image-style, you should be able to access these files.  If you've recovered by installing Windows from the installation disc, then you have created a new and different installation with different Secure ID (SID) and a certificate store empty.  A recovery agent will only retrieve encrypted files that were created after that recovery agent was in place - as a new certificate.  What you really need to do, it's your old certificate to restore the backup that you created when you started using EFS.  The following article is mandatory for anyone using the EFS file system.  Special attention to the paragraph entitled "why you should back up your certificates.

  "Best Practices for encrypting file system"
   <>http://support.Microsoft.com/kb/223316 >

  If you do not have a return to the top of your certificate, then things look dark.  There is a program called "AEFSDR' whose 'professional' version comes through what has not been overwritten on your hard drive in search of remains of certificates that could be delivered together to recover.

  Good luck
  HTH,
  JW

• Cannot access the system files with permissions to access EFS and certificate are set correctly.

  I am running EFS on a secondary internal hard drive on my computer Vista Enterprise SP1.  I have been using EFS for a few months with no problems.  Recently, when you try to access a number of files, I started getting access denied errors.  I'm still under the same certificate with same file permissions that I was when I originally encrypted the files.  Curiously, I can move, delete and rename files without problem, but I can not access, copy, or decrypt.  I tried reseting the file permissions, nothing done.  An excerpt from the command line:

  D:\>ICACLS FILE name. MOV

  NAME OF FILE. MOV : (F)

  BUILTIN\Administrators: (I) (F)

  NT AUTHORITY\SYSTEM: (I) (F)

  NT AUTHORITY\Authenticated Users: (I) (M)

  Builtin\Users: (I) (RX)

  Processed 1 files successfully; Treatment failure 0 files

  D:\>cipher/y

  Thumbprint for computer certificates EFS ComputerName:

  D:\>cipher/c FILENAME. MOV

  List D:\

  New files added to this directory will not be encrypted.

  E FILE NAME. MOV

  Users who can decrypt:

  Thumbprint of the certificate:

  No recovery agent.

  Important information:

  Algorithm: AES

  Key length: 256

  Entropy key: 256

  D:\>cipher/d FILENAME. MOV

  Decryption of files in D:\

  NAME OF FILE. MOV [ERR]

  NAME OF FILE. MOV: Access denied.

  0 file (s) [or directorie (s)] in 1 directorie (s) have been deciphered.

  D:\ >

  The only thought I have is that maybe the metadata associated with the EFS file is damaged?  I'm open to any new idea to access my files.  Thank you in advance.

  Hi Dekaner,

  Your question of Windows Vista is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please ask your question in the Forum Technet Windows Vista security permissions and. Thank you!

  Lisa
  Microsoft Answers Support Engineer
  Visit our Microsoft answers feedback Forum and let us know what you think.

• investigation on certificates and applications/files on my computer that I did not istall or apply

  have found some strange files in the computer on which I have installed apparently but I don't not do not know what they are, but no 41 a5 7f 22 f2 2d 9 d 4 c 53 f4 51 17 ac Signature Algorithm sha 1RSA e9, hoping you can help me a SAI, it is a version V3, serial also increased confidence in hand to use the key pair. If someone has installed some sort of spyware thing and that they are able to monitor everything I do. I also of things strange tpo me in programs menu security certificate Crypto shell extensions of file, file of character agent Microsoft application unknown format HTTP can someone help me understand if this is normal or not and if not, maybe you can tell me how to remove it thank you very much...

  Hello kathrynbaker1,

  ·         What is the operating system installed on your computer?

  ·         Remember to make changes to the computer until you have noticed that these files and programs appeared on your computer?

  ·         Where exactly the files stored on your computer and what happens when you open these files?

  However, I see that the Microsoft Agent is a software that enables an enriched form of user interaction that can make using and learning to use a computer easier and more natural.

  See this link for more information on this:

  http://www.Microsoft.com/products/msagent/main.aspx

  Some certificates are installed on your computer if you visit some Web sites on the computer.

  Also make sure you have a safety program installed on your computer and the firewall active.

  You can also run a scan Windows Onecare online to make sure that there is no infection spyware or malware on your computer. Here is a link you can follow:

  http://OneCare.live.com/site/en-my/default.htm?mkt=en-my

  Thank you
  Irfan H, Engineer Support Microsoft Answers. Visit our Microsoft answers feedback Forum and let us know what you think.

• Switch to the correct encryption certificate I get the error: "Key not valid for use is specified state."

  Used
  Now cannot open encrypted files.

  When you try to pass the correct encryption certificate I get the error:
  "Key not valid for use is specified state."

  See this http://answers.microsoft.com/en-us/windows/forum/windows_7-security/keeping-passwords-secure-microsoft-policy-on/39f56ef0-5d68-41ad-9daa-6e6019c25d37

  It is as it's supposed to as an anti theft precautions. I mean that data is encrypted, if somebody stole your hard drive and the hard drive boots and the other account it can receive data.

  If you not export recovery certificates and encrypting the data, you cannot redo the decryption.

  http://Windows.Microsoft.com/en-us/Windows/back-up-EFS-certificate#1TC=Windows-7

  If it's a default domain recovery agent. admin area. If it's home, to look for recovery certified you have exported.

  But third-party tools are there if you can remember old password the is to encrypt you can recover. But they are not free... and premium software is not be recommended or guided through support free forum due to the effort of preventing unnecessary advertising.

  You can do you own research about recovering data... just try to get you using the favorite search engine... "Restore access to encrypted EFS format files" or "Advanced EFS Data Recovery.

  Many more free guides will be available... Just keep in mind this is not a method to escape... you must remember your old password at least for decryption in the case where you export a certificate.

• Authentication computer certificate and windows domain check

  Hello

  We intend to deploy machine? s certificates of authentication for wifi users.

  We want to check the validity of the certificate of the machine and that the machine is included on the windows domain.

  We intend to use EAP - TLS:

  -A CA server.

  -each machine (laptop) retrieves its own certificate to GPO or SMS

  -the public certificate of the CA is pushed on GBA as well as on each machine (laptop)

  -ACS version is the one device

  -a remote ACS agent installed on the A.D.

  -When a user intends to log on to the wireless network:

  -(device ACS) server sends its certificate to the client. This client checks the certificate with the certificate of the CA server there already trust, results: the customer also hope the ACS? s certificate signed by the CA server.

  -the client sends its certificate on the server (ACS unit). This ACS checks the certificate with the certificate of the CA server there already trust, results: GBA also hope the customer? s certificate signed by the CA server but the ACS also checks to see that the certificate isn't? t revocated (GBA check it thanks to the CA CRL server? certificates revocation list).

  I'm right about these previous points?

  And then my question is: is it possible to check that the machine is also included in the windows domain?

  In other words, is it possible for the candidate countries get the necessary field (maybe CN? certificate type "host /...") "), and then do an authentication request to the AD (active directory) with the remote agent of GBA? We just want machine authentication, the authentication of the user not.

  Thanks in advance for your attention.

  Best regards

  Arnaud

  Hi Arnaud,.

  You are right.

  Once the Remote Agent is configured correctly. And clients are configured correctly.

  It will work the way you want.

  Another option to consider,

  Also check 'enable machine access restrictions '.

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp354338

  Kind regards

  Prem

• ACS appliance fails to recognize an installed certificate

  When I install a certificate from CA - Windows Server, following the procedure of "Wired Dot1x version 1.05 Config guide" (Document ID 64068) and the 'Guide user to ACS,' I have the following problem. If I want to change the "overall authentication settings', I get the warning"could not initialize the PEAP or EAP - TLS authentication protocol because the certificate authority is not installed. Install the certification authority using the ACS Certification Authority Setup page".

  But if I check "install Certificate", it is said that the certificate is installed correctly and it is also added to the "Configuration page of the authority.

  I already found the following in the as 4.1.4 release notes: "turn off the Security agent, reinstall the certificate in accordance with the procedure and then re - activate the security officer.

  I did it but I still have the same error, even if the security officer is disabled (I checked it in the console with the command 'show' and the CSA is off).

  Can someone help me how to recognize the installed certificate?

  P.S. I also see 2 devices in the AAA-server list:

  -ACS01 (the name I gave him in the initial configuration). This one has an IP address of the DHCP server, even if I said NOT to use a DHCP server, but a static IP!

  -Self: this one has the static IP I configured via the console...

  I can't remove one of the AAA servers. Is it normal that there are 2 servers?

  Bert,

  It seems that the certification authority that you have installed is damaged or poorly installed. I want do you is remove the certicate CA by using the MMC on windows in ACS and then reinstall it.

  You, too, need to install the certificate authority root in ACS. You can install the certificate authority root in System Configuration-> ACS certificate of installation-> ACS certificate authority installation.

  Also incase you use Verisign cert, you install VeriSign intermediate CA certificates.

  https://www.VeriSign.com/support/VeriSign-intermediate-CA/index.html

  Kind regards

  ~ JG

• ERROR: receive the CA certificate: status = FAIL

  Hi all

  We installed the new authority MS root CA and (Windows Server 2008 R2 Enterprise) certification. When I tried to get the certificate of authority of some Cisco Cisco WS-C3560-24PS devices, it fails.

  Debug:

  QL - SW3 (config) #CRYPTO CA authenticate ESSAUDE

  092306: Mar 27 11:47:38.075 PT: CRYPTO_PKI: CA certificate request:
  GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=ESSAUDE HTTP/1.0
  User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
  Host: 10.0.4.2

  092307: Mar 27 11:47:38.075 PT: CRYPTO_PKI: trustpoint locked ESSAUDE, refcount is 1
  092308: Mar 27 11:47:38.075 PT: CRYPTO_PKI: cannot resolve the server name/IP address
  092309: Mar 27 11:47:38.075 PT: CRYPTO_PKI: using 10.0.4.2 unresolved IP address
  092310: Mar 27 11:47:38.084 PT: CRYPTO_PKI: open http connection
  092311: Mar 27 11:47:38.084 PT: CRYPTO_PKI: HTTP send message

  092312: Mar 27 11:47:38.084 PT: CRYPTO_PKI: HTTP header:
  HTTP/1.0
  User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
  Host: 10.0.4.2

  092313: Mar 27 11:47:38.084 PT: CRYPTO_PKI: trustpoint unlocked ESSAUDE, refcount is 0
  092314: Mar 27 11:47:38.084 PT: CRYPTO_PKI: trustpoint locked ESSAUDE, refcount is 1
  % Error in receiving the certificate of the CA: status = FAIL, length cert = 0

  QL - SW3 (config) #.
  QL - SW3 (config) #.
  QL - SW3 (config) #.
  092315: Mar 27 11:47:53.393 PT: CRYPTO_PKI: trustpoint unlocked ESSAUDE, refcount is 0
  092316: Mar 27 11:47:53.393 PT: CRYPTO_PKI: HTTP header:
  HTTP/1.1 500 Internal Server Error
  Content-Type: text/html
  Server: Microsoft-IIS/7.5
  Date: Thu, 27 March 2014 11:47:53 GMT
  Connection: close
  Content-Length: 1208

  Content-Type indicates that we have not received a certificate.

  092317: Mar 27 11:47:53.401 PT: CRYPTO_PKI: transaction completed GetCACert
  QL - SW3 (config) #.

  Anyone have idea?

  concerning

  Looks like your CA server returns a 500 error.

  You can check this by accessing this URL (http://10.0.4.2/certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=ESSAUDE) using a browser. If it's all working, you should be able to download the certificate of the CA in this way (save it to, for example, ca.crt and try to open it).

  I am not sure, because I don't know how your CA is implemented, but I think that the registration URL you configured in your trustpoint on the switch might be wrong. It works on all devices, or is it just these switches of the problems?

  -hugh