Downloading a trust certificate revocation list fails

Last Updated : Jul 30, 2015 |
Prolog information
Metadata
Keywords:

Condition

After clicking Download CRL on the EMSecurityCertificate ManagementTrust Store page, you see an error that the system could not download the certificate revocation list (CRL) from the trust store.

Cause

Possible causes for this problem include:
  • A connection failure because of incomplete mutual authentication configuration between Avaya Aura® MS EM and the server hosting the CRL
  • An import failure has occurred after the CRL is downloaded. CRL formats other than DER are not supported and cannot be imported.

Proposed Solutions

Resolving a connection failure
Ensure that there is correct mutual authentication configuration between Avaya Aura® MS EM and the server hosting the CRL by performing the following imports:
  • Import the CA Certificate that signs the key certificate for the server hosting the CRL into the Avaya Aura® MS trust store.
  • Import the CA Certificate that signs the key certificate for the AMS Clustering service into the trust store of the CRL server.
Resolving import failures
Perform the following procedure to ensure that the CRL distribution point URI and CRL format are correct:
  1. Determine the CRL distribution point URI in the CA certificate. You can do so by using the following OpenSSL command to view the certificate contents and obtain the URI:
    ADDITIONAL INFORMATION:
    openssl x509 –text –noout –in certfilename
  2. Copy the CRL distribution point URI from the certificate and paste it into the URL field of a browser.
    ADDITIONAL INFORMATION:
    The CRL downloads if the CRL distribution point URI is valid. If the download fails, the CRL distribution point URI is invalid or obsolete.
  3. If the CRL distribution point URI downloads, then verify the format of CRL. DER files are binary. PEM files are Base64 encoded.
  4. Avaya Aura® MS supports the DER format. If the file is in PEM format, you can convert the PEM file to DER format by using the following OpenSSL command:
    ADDITIONAL INFORMATION:
    openssl crl -in inputfile -outform DER -out outputfile
    For example:
    openssl crl -in crl.pem -outform DER -out crl.der
  5. Perform the following procedure to manually import the DER formatted:
    1. Navigate to EMSecurityCertificate ManagementTrust Store.
    2. Select the required trust store certificate authority from the list.
    3. Click Import CRL
    4. Click Browse and select a file to set the Trust certification revocation list import file field.
    5. Click Save.