ERROR: receive the CA certificate: status = FAIL

Hi all

We installed the new authority MS root CA and (Windows Server 2008 R2 Enterprise) certification. When I tried to get the certificate of authority of some Cisco Cisco WS-C3560-24PS devices, it fails.

Debug:

QL - SW3 (config) #CRYPTO CA authenticate ESSAUDE

092306: Mar 27 11:47:38.075 PT: CRYPTO_PKI: CA certificate request:
GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=ESSAUDE HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
Host: 10.0.4.2

092307: Mar 27 11:47:38.075 PT: CRYPTO_PKI: trustpoint locked ESSAUDE, refcount is 1
092308: Mar 27 11:47:38.075 PT: CRYPTO_PKI: cannot resolve the server name/IP address
092309: Mar 27 11:47:38.075 PT: CRYPTO_PKI: using 10.0.4.2 unresolved IP address
092310: Mar 27 11:47:38.084 PT: CRYPTO_PKI: open http connection
092311: Mar 27 11:47:38.084 PT: CRYPTO_PKI: HTTP send message

092312: Mar 27 11:47:38.084 PT: CRYPTO_PKI: HTTP header:
HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
Host: 10.0.4.2

092313: Mar 27 11:47:38.084 PT: CRYPTO_PKI: trustpoint unlocked ESSAUDE, refcount is 0
092314: Mar 27 11:47:38.084 PT: CRYPTO_PKI: trustpoint locked ESSAUDE, refcount is 1
% Error in receiving the certificate of the CA: status = FAIL, length cert = 0

QL - SW3 (config) #.
QL - SW3 (config) #.
QL - SW3 (config) #.
092315: Mar 27 11:47:53.393 PT: CRYPTO_PKI: trustpoint unlocked ESSAUDE, refcount is 0
092316: Mar 27 11:47:53.393 PT: CRYPTO_PKI: HTTP header:
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/7.5
Date: Thu, 27 March 2014 11:47:53 GMT
Connection: close
Content-Length: 1208

Content-Type indicates that we have not received a certificate.

092317: Mar 27 11:47:53.401 PT: CRYPTO_PKI: transaction completed GetCACert
QL - SW3 (config) #.

Anyone have idea?

concerning

Looks like your CA server returns a 500 error.

You can check this by accessing this URL (http://10.0.4.2/certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=ESSAUDE) using a browser. If it's all working, you should be able to download the certificate of the CA in this way (save it to, for example, ca.crt and try to open it).

I am not sure, because I don't know how your CA is implemented, but I think that the registration URL you configured in your trustpoint on the switch might be wrong. It works on all devices, or is it just these switches of the problems?

-hugh

Tags: Cisco Security

Similar Questions

  • Certificate authority certificate: status = FAIL, length cert = 0

    Hi all

    We installed the new authority root MS certification and certification (Windows Server 2008 R2 Enterprise) in the test environment. When I tried to get the certificate of the CA of some Cisco devices (router 1800, ASA 5510 5520), it failed. It's the same situation with "application url" or a "terminal entry" command:

    Router:

    Authenticate the PKI-test (config) #crypto ca NIS_CA
    % Error in receiving the certificate of the CA: status = FAIL, length cert = 0

    PKI-test (config) #.
    23 Nov 16:17:01.764: CRYPTO_PKI: CA certificate request:
    GET /certsrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=NIS_CA HTTP/1.0
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
    Host: xxxxxx

    23 Nov 16:17:01.768: CRYPTO_PKI: trustpoint locked NIS_CA, refcount is 1
    23 Nov 16:17:01.768: CRYPTO_PKI: open http connection
    23 Nov 16:17:01.768: CRYPTO_PKI: HTTP send message

    23 Nov 16:17:01.768: CRYPTO_PKI: HTTP response header:
    HTTP/1.0
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Cisco PKI)
    Host: xxxxxxx

    23 Nov 16:17:01.772: CRYPTO_PKI: trustpoint unlocked NIS_CA, refcount is 0
    23 Nov 16:17:01.772: CRYPTO_PKI: trustpoint locked NIS_CA, refcount is 1
    23 Nov 16:17:01.776: CRYPTO_PKI: trustpoint unlocked NIS_CA, refcount is 0
    23 Nov 16:17:01.776: CRYPTO_PKI: HTTP response header:
    HTTP/1.1 200 OK
    Content-Length: 5810
    Content-Type: application/x - x 509-ca-ra-cert
    Server: Microsoft-IIS/7.5
    X-Powered-By: ASP.NET
    Date: Tuesday, November 23, 2010 16:17:01 GMT
    Connection: close

    Content-Type indicates that we have received certificates of CA and RA.

    16:17:01.776 on 23 nov: CRYPTO_PKI:crypto_process_ca_ra_cert(trustpoint=NIS_CA)

    16:17:01.788 on 23 nov: #7 message PKCS contains 4 certificates.
    23 Nov 16:17:01.792: CRYPTO_PKI: status = 0 x 712 (E_ATTRIBUTE_VALUE_LEN: length of attribute value is not valid (% n0)): returned crypto_pkcs7_extract_ca_cert
    23 Nov 16:17:01.792: CRYPTO_PKI: unable to read certificates of AC/AE.
    16:17:01.792 on 23 nov: % ICP-3-GETCARACERT: did not have certificates of RA/CA.
    23 Nov 16:17:01.792: CRYPTO_PKI: transaction completed GetCACert

    ASA:

    Authenticate the crypto ca ASA (config) # QLABCA

    CRYPTO_PKI: HTTP response header:
    HTTP/1.1 200 OK
    Content-Length: 5810
    Content-Type: application/x - x 509-ca-ra-cert
    Server: Microsoft-IIS/7.5
    X-Powered-By: ASP.NET
    Date: Saturday, November 27, 2010 16:57:43 GMT
    Connection: close

    Content-Type indicates that we have received certificates of CA and RA.

    CRYPTO_PKI:crypto_process_ca_ra_cert(Trustpoint=QLABCA)

    crypto_certc_pkcs7_extract_certs_and_crls failed (1795):
    crypto_certc_pkcs7_extract_certs_and_crls failed
    Returned 1795 CRYPTO_PKI:crypto_pkcs7_extract_ca_cert

    ERROR: receive the CA certificate: status = FAIL, length cert = 0

    Is it possible that the Cisco devices don't support CA root public key length 4096 and subordinates CA 2048?

    Or someone has another idea?

    Thanks in advance...

    Yes, this could be the problem.  ASA does not support the SHA2 as of yet.

    -Jason

  • Unable to connect to the VMware Research Service - the SSL certificate verification failed

    Hello world

    to implement the new vCSA 5.1 but I get an error when you try to connect via browser Web Client.

    "Impossible to connect to the VMware Research Service . https://xxx.xxx.xxx.xxx:7444/lookupservice/sdk - The SSL certificate check failed. »

    I've found this KB

    http://KB.VMware.com/selfservice/search.do?cmd=displayKC & docType = kc & externalId = 2033338 & sliceId = 1 & docTypeID = DT_KB_1_1 & dialogID = 423540040 & StateID = 1% 200% 20423538503

    The manual/work around seems to be a lot of work for me and perhaps this will cause other problems in the service due to problems of certification :/

    I also think that this cannot be the solution for a whole new vCSAppliance...-_-

    I am also able to go to https://xxx.xxx.xxx.xxx:9443 / admin-app

    is it correct for the device?

    You need to regenerate the certificate for Server Appliance after change of IP/hostname.

    Visit this link: http://www.virtual-blog.com/2012/09/failed-to-connect-to-vmware-lookup-service/

    Also, the admin/management interface is https://: 5480

    Lack of credentials [root/vmware]

    HTH

  • Unable to connect to the laptop, receive error message "the user profile service failed.

    can not connect to the computer

    * original title - I can't connect on the laptop when I put in password says the USER PROFILE SERVICE FAILED THE LAGOON AND DO CAN NOT BE LOADED a *.

    Hi vincentbyrne


    What operating system is installed on the computer?

    You can refer to the link below and use the provided steps to identify the installed operating system.

    http://Windows.Microsoft.com/en-us/Windows7/help/which-version-of-the-Windows-operating-system-am-i-running


    If you are using Windows Vista or Windows 7 based computer you can see Microsoft article provided below and check if the measures help -.

    http://support.Microsoft.com/kb/947215

     

    I hope this helps.

  • Error in the Alert.log - ksvcreate: failed to create Process()

    Below the message error is repeated in the alert.log everyday:

    ksvcreate: failed to create Process()

    The trace for MMON file is updated every time that this error is reported in the alert.log. Here is the error message from the trace file:

    Impossible to program a MMON slaves to: Auto Flush main 1
    Try to create slave processes failed.
    Can occur for several reasons:
    -Any process state object
    -OS limits reached
    -A stop happening
    Check the log of alerts for details.
    KELR apply log: could not schedule MMON slave, error 3

    I checked using process of the database and use is much lower maximum. Verified on OS limits and who also is set to a high value.

    Is there anyone who received the similar error message and got a very practical resolution.

    DB version: 10.2.0.1
    OS version: Linux 2.6.18

    Hello

    Ask your question to the appropriate General database Discussions.

    Thank you
    Hussein

  • Receiving the message "Wireless association failed because Windows did not receive response from the access point or wireless router" _

    My laptop was working fine yesterday, but when I started it today I get the message "Wireless association failed because Windows did not receive response from the access point or wireless router.

    I can see my network and I can connect to the internet using my desktop pc, but just to make complicated I can't even connect to the network when I plug the ethernet cable into my laptop.

    I think it might be a driver problem, but I have no idea how to solve this problem without access to the internet on my laptop.

    I'm running Vista and my wireless router is an Atheros AR5009 809.11a/g/n

    I need step by step instructions on this Yes please treat me like a fool!

    Thank you

    Laptop would not work at home thus concluded that it was a BT Broadband do not issue my driver (despite BT telling me the opposite last night)

    After the call to a fantastic Lady in BT it's all fixed and thanks to Jack I now know a lot more on connecting wireless to my laptop!

  • Zero error of the client certificate provided is not rooted in the devices certificate store after upgrade to the Horizon view 6

    We have just updated our infrastructure VMware View Horizon of 5.3 to 6.0.1 and all zero clients are provided certificate is not rooted in the devices certificate store.  The certificate on the brokers of the connection has not changed.  Customer relationship connections Horizon view a connection, as well as when we connect to the connection to the server via a web browser.  We had no cert errors before the upgrade.

    You need to add the following as PEM files to fix the problem on the zero client.

    The intermediate certificate - DigiCertCA.crt

    The root - TrustedRoot.crt certificate

  • Error message: "the security certificate has expired or not valid" when signing into emails

    original title: it is message apear signin to my email (the security certificate is expired or not valid) my windos xp professional version - what can I do

    It is message apear signin to my email (the security certificate is expired or not valid) my windos xp professional version - what can I do

    Chances are that your system clock is bad - check your regional settings in the control panel and make sure that your region, time, date, and year are correctly configured.

  • Error installing the camera Kodak Easyshare failed on Windows 7

    Original title; Photos of transfer problems. Device is not install properly

    I bought a new Kodak easy share camera. When I plugged in my computer transfer pictures USB driver said that installing the unit has failed and the camera does not appear on "my computer" as a removable as it should. I plugged into the Mac of my mother and went right in the Setup program, as it is supposed to is not my camera that is the problem. Any ideas?

    Hello

    1. What is the exact error message you get?

    2 have you installed the software for the device?

    3. What is the exact make and model of the Kodak camera?

    You can check if there are errors appearing in Device Manager (usually a yellow exclamation next to it).

    Open the Device Manager

    http://Windows.Microsoft.com/en-us/Windows7/open-Device-Manager

    I also you suggest to install the software that came with the device and then try to plug in and check.

    You can download and install the application from the link below:

    KODAK EASYSHARE Software - WINDOWS operating systems

    http://support.en.kodak.com/app/answers/detail/A_ID/36670/selected/true

    You can also go through the help of Easyshare software to:

    http://resources.kodak.com/global/en/service/help/easyShare_v8_2/Webhelp/EasyShare_Software_Help.htm

  • HP Envy 7640: Receives the message "print status interface is not responding" after upgrade to windows 10

    After the upgrade to windows 10 I have to manually delete each message in the queue.  I can print one message and then I have to go into devices and printers and delete this message before I can print another.  I have a wireless internet connection.  I checked the print spooler and it is set to automatic.

    It is an addition to this post:

    Later, after downloading the latest version of the software and reinstall the printer, the problem has been corrected.

    Hi, uninstall the printer software and download the installation software for free using this linkHP.

  • Error in the grid agent status

    Hello
    I have a grid control on linux RHEL4 and node 4 CARS on RHEL4.
    for several days there are all targets of one of the nodes (DB, instance, earphone) are inaccessible.
    How can I diagnose this problem?

    plus I deceide reinstall this node agent, how can I do?

    I have a grid control on linux RHEL4 and node 4 CARS on RHEL4.
    for several days there are all targets of one of the nodes (DB, instance, earphone) are inaccessible.
    How can I diagnose this problem?

    Agent unreachable
    Check the messages from mdecker.

    plus I deceide reinstall this node agent, how can I do?

    You can re - install the agent using YES (setup.exe) from the oem cd
    Remove the existing Agent (click on installed products, select the agent oracle_home and click on delete)
    And then install a new one. (Click on additional Management Agent and proceed...)

  • Impossible to install iTunes on XP, gives the error about the signature and certificate

    I can't install itunes on my pc, it gives me an error about the signature & certificate. Its probably my settings but I have no idea how to change anything! Not computer savvy

    Check the time and date on your computer. This is probably the cause.

    http://support.Microsoft.com/kb/307938

  • When you try to create the safety PIN or password photo, get the error "the remote procedure call failed."

    Logon to an account on the Win8 Pro system.  In the PC settings. Your account, try to create a PIN.  You will be asked your password, and when I enter the password, the tracking error.  "The remote procedure call failed."

    In the application event log, we see:

    The failing application name: CredentialUIBroker.exe, version: 6.2.9200.16384, time stamp: 0x5010a22d

    The failed module name: nvwgf2umx.dll, version: 9.18.13.1070, time stamp: 0x50b976f6

    Exception code: 0xc000041d

    Offset: 0 x 0000000000135122

    ID of the process failed: 0 x 1160

    Start time of application vulnerabilities: 0x01cddfd4b4a988ef

    The failing application path: C:\Windows\System32\CredentialUIBroker.exe

    Path of the failing module: C:\Windows\System32\nvwgf2umx.dll

    Report ID: fdf0d095-4bc7-11e2-be7a-e0cb4e8a55c5

    Faulting full name of the package:

    ID of the failed package-parent application:

    I did a search of exhaust gases and am not finding that anything related.

    Action taken:

    ran sfc/scannow and no reported problems.

    Need to stop the application to quit.

    I found the problem for the updated NVidia driver.  Once I disabled the display driver USB 3.0 that acts as a method to connect to a computer USB 3.0 (also tactile) monitor, the driver installed correctly and does not interfere with any of the Windows applications.
    Also, try to remove all the accounts on your system that are not user accounts that some applications will add them without apparent reason.  Applications still work correctly.  It's just less sure there to access your system.

  • Internal error during the installation of DirectX for the user final web runtime install

    Hi all

    I was browsing the forums and reading the discussions that relate to my question.  Unfortunately, each of the solutions that I found do not seem to solve my specific problem.
    I recently got a new laptop (Dell E6540) and thought I'd try world of combat aircraft.  My old laptop did not have a graphics card that has been up to the task, but I think this one does.
    I am running Windows 7, which integrates the latest version of DirectX (11).  I downloaded and installed the game, and when I click on 'Play', I get the message informing me that I'm missing the d3dx9_43.dll.  I then visit the Microsoft Download Center and try to download the installer of web runtime DirectX end-user.  Following the installation of the components in the stage of finalisation of the web installer, I get the following message:
    "An internal system error has occurred.  Please refer to DXError.log and DirectX.log in your Windows folder to determine the problem. »
    I then click OK in the error message, the web installer shows failed to install, so I click "Finish."  At this point, the popsup Program Compatibility Assistant, saying: the program may not be installed properly and gives me the opportunity to 'Reinstall using recommended settings', what I'm doing.  Then run the web installer a second time, giving me the same error internal system presented above.
    I wonder if someone might have suggestions as to how I can resolve this issue (or to find the above mentioned .log files).
    Thanks for your help.

    While Win7 installed DX 9, 10 and 11 it does not install with all files.
    d3dx9_43.dll is the latest DX 9 files.
    The best method when you have not already updated DX is to use the DX Web Installer,.
    then you can try using them.
    Download DirectX end-user Runtime Web Installer from the official Microsoft Download Center

    If you have the same problem with the DX Web Installer trying to boot into Safe Mode with networking
    and try to run the installation program from there Web DX.

    -L' Web Installer does not overwrite the DX files, it only installs the DX 'missing' files, so when it
    is a DX of corrupted files and you do not receive an error with the name that you will need to use the full
    DirectX Redist (2010), which I assume is what you are trying to use, as this will overwrite all the
    DX files.
    -Similarly, you can use Safe Mode (networking not required that you have all files) may
    be used when there is a problem installing DX with the complete installation program.

    -When there is a corrupted file of DX and you get the name of this file, an error, as with
    your d3dx9_43.dll, you can delete this file in System32 (sysWOW64 when using 64-bit
    Windows) and when you run the Web Installer will replace the now "missing" with a new file
    copy.

    Absence of the foregoing, it may be your problem is more to do not have the necessary permissions to
    install the DX.
    This could be due to UAC settings too high, does not not as administrator or another
    restrictive framework, maybe even your anti-virus (disable temporarily when trying to install DX).
    Try - R / click the DXSETUP.exe. Then go to Properties-compatibility and check the box
    next to the race... as an administrator.
    .

    .

  • The remote procedure call failed and did not run + user problem?

    Good so I have a Sony VAIO with Windows 7 Home Premium 64-bit, 4 GB RAM and 640 GB hard drive. During his first installation, VAIO asks you to name your computer so I called him "CARINA" and everything worked perfectly.

    However, we wanted to change the main username in the 'OSCAR', so I went to the control panel > users and this has changed. I thought that everything was great, because when I open the Start Menu, top-right, he says "OSCAR". After more research in the area of research, two things appears under the name 'CARINA': a 'user profile', I think, who had a small square color sky-blueish. and a folder with a lock on it. I tried clicking on the user 'CARINA' first profile, and it just opened what, in my view, is a Properties window 'CARINA '.

    But when I clicked on the folder "CARINA" with a lock, it opened my libraries. But get this: at the top, he said not "CARINA", but "OSCAR". I thought it was odd he did that so I told the computer to delete the folder with the lock named 'CARINA '. As soon as I realized it was a huge file and a gazillion files were there (real libraries), I canceled it, he wants to immediately restore the Recycle bin. But nothing appears on the trash, or I can't enter either because an error saying "the remote procedure call failed and did not execute".

    But the mistake has been made and now it does not work. The Start Menu appears, but I can't click on anything or use the search box. When I click on my library of records, the same message appears ("the remote procedure call failed and did not execute") or when I enter 'Open action center', he said ': {266EE0668-A00A-44D7-9371-BEB064C98683}\5\::{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB...» The remote procedure call failed and did not execute. " Programs on my toolbar work, such as Chrome or Windows Media, or I can change the volume with the icon in the lower right, but I can not enter in 'Computer', my libraries, or anything else. When I open the the TASK Manager, under processes, they are all under the name CARINA. If I stand on the top of the "explorer.exe" process, and I do a right-click on top of CARINA > properties > Security > there are 4 listed users:

    • SYSTEM
    • Administrators (CARINA-VAIO\Administrators)
    • Users (CARINA-VAIO\Users)
    • TrustedInstaller

    The computer has a backup (if I have a backup of an another VAIO Windows 7 Home Premium 64 - bit if necessary) and I'm afraid to stop in case it does not start again. :(

    Any help? What can I do?

    Hello

    Method 1:

    Follow the steps mentioned below.

    (a) type services in the start menu search box.

    (b) in Services, scroll down to "Remote Procedure Call", and make sure the status 'Started' and set to automatic.

    (c) the second "RPC Locator' must be set to"manual ".

    Method 2:

    I suggest you to scan SFC. Scan SFC will be scans all protected system files and replaces incorrect versions with appropriate Microsoft versions.

    How to use the System File Checker tool to fix the system files missing or corrupted on Windows Vista or Windows 7
    http://support.Microsoft.com/kb/929833

    Note:
    I suggest you check manage user accounts to check how many user accounts are present.

    a. Click Start.
    b. go to the control panel.
    c. click user accounts and family safety, and click on user accounts.

    Check how many accounts user is present.

    Method 3:
    I suggest you to create the new user account and check if the problem persists.

    Create a user account
    http://Windows.Microsoft.com/en-in/Windows7/create-a-user-account

    If everything works well in the new user account, then I suggest you to transfer data and settings to the fixed aid corrupt profile.

    Difficulty of a corrupted user profile
    http://Windows.Microsoft.com/en-in/Windows7/fix-a-corrupted-user-profile

Maybe you are looking for