OSCP CRL request not working!!!

Hello, I have a Cisco router that I am trying to get a certificate based VPN working on, I have most of the parts working correctly, however I would like to have OCSP crl lookup working. however everytime I go to do a CRL lookup I get this error:
*Mar 26 17:54:22.209: CRYPTO_PKI: Removing cached pubkeys for CRL issuer
*Mar 26 17:54:22.209: CRYPTO_PKI: create new ca_req_context type PKI_POLL_CRL_CONTEXT,ident 42
*Mar 26 17:54:22.209: CRYPTO_PKI: (0)Retreive CRL using HTTP URI
*Mar 26 17:54:22.209: CRYPTO_PKI: Bypassing SCEP capabilities request 0
*Mar 26 17:54:22.209: CRYPTO_PKI: (0) Requesting CRL at http://192.168.4.104:8080:
*Mar 26 17:54:22.209: CRYPTO_PKI: (0) Fetch 0
*Mar 26 17:54:22.209: CRYPTO_PKI: locked trustpoint OPENSSL, refcount is 1
*Mar 26 17:54:22.213: CRYPTO_PKI: http connection opened
*Mar 26 17:54:22.213: CRYPTO_PKI: Sending HTTP message
reda(config)#
*Mar 26 17:54:22.213: CRYPTO_PKI: Reply HTTP header:
HTTP/1.0
Host: 192.168.4.104
reda(config)#
*Mar 26 17:54:24.213: CRYPTO_PKI: unlocked trustpoint OPENSSL, refcount is 0
*Mar 26 17:54:24.213: CRYPTO_PKI: Send HTTP header:
GET HTTP/1.0
Host: 192.168.4.104
*Mar 26 17:54:24.213: CRYPTO_PKI: HTTP data
47 45 54 20 20 48 54 54 50 2F 31 2E 30 0D 0A 48
6F 73 74 3A 20 31 39 32 2E 31 36 38 2E 34 2E 31
30 34 0D 0A 0D 0A 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00
*Mar 26 17:54:24.213: CRYPTO_PKI: locked trustpoint OPENSSL, refcount is 1
*Mar 26 17:54:24.217: CRYPTO_PKI: unlocked trustpoint OPENSSL, refcount is 0
*Mar 26 17:54:24.217: CRYPTO_PKI: Reply HTTP header:
HTTP/1.0 200 OK
Content-Type: application/ocsp-response
Content-Transfer-Encoding: Binary
Content-Length: 5
Date: Mar 26 17:57:15 2015 GMT
Expires: Mar 26 18:02:15 2015 GMT
*Mar 26 17:54:24.217: CRYPTO_PKI: HTTP header content length is 5 bytes
*Mar 26 17:54:24.217: CRYPTO
reda(config)#_PKI: FETCH IO data 30 03 0A 01 01
*Mar 26 17:54:24.217: CRYPTO_PKI: processing CRYPTO_INSERT_CRL but session id (0) is not valid
*Mar 26 17:54:24.217: CRYPTO_PKI: (0) Verify incoming CRL
*Mar 26 17:54:24.217: ../cert-c/source/crlobj.c(504) : E_BER_ENCODING : invalid encoding format for input data
*Mar 26 17:54:24.217: %PKI-4-CRLINSERTFAIL: Trustpoint "OPENSSL" failed to parse CRL (error 1793:E_BER_ENCODING : invalid encoding format for input data)
*Mar 26 17:54:24.217: CRYPTO_PKI: transaction Unknown completed
on the OCSP side I get this error:
Network Error while reading Request!
I am using cisco 881 routers and my OCSP server is OPENCA OCSPD
When I do a wireshark trace of the incomming and outgoing packets on the OCSP server I see a http get request comming in, and a ocsp reply "responseStatus: malformedRequest (1)" going out
here is my router configuration
reda#show run
Building configuration...
Current configuration : 3985 bytes
! Last configuration change at 18:04:27 UTC Thu Mar 26 2015
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname reda
boot-start-marker
boot-end-marker
aqm-register-fnf
no aaa new-model
crypto pki trustpoint OPENSSL
enrollment terminal
fqdn reda.engageinc.com
revocation-check ocsp
ocsp url http://192.168.4.104:8080
ocsp disable-nonce
rsakeypair BRANCH_KEY
crypto pki crl cache size 2048
crypto pki certificate chain OPENSSL
certificate ca 00A3A5C798F3C3312A
308203EF 308202D7 A0030201 02020900 A3A5C798 F3C3312A 300D0609 2A864886
F70D0101 05050030 18311630 14060355 04030C0D 42564341 206E756D 62616820
32301E17 0D313530 33323631 37343935 345A170D 31363033 32353137 34393534
5A307431 0B300906 03550406 13025553 31133011 06035504 08130A43 616C6966
6F726E69 61311D30 1B060355 040A1314 456E6761 67652043 6F6D6D75 6E696361
74696F6E 31143012 06035504 0B130B65 6E67696E 65657269 6E67311B 30190603
55040313 12726564 612E656E 67616765 696E632E 636F6D30 82012230 0D06092A
864886F7 0D010101 05000382 010F0030 82010A02 82010100 A58DD944 7A6F5BD4
DA6BFE90 B2470DC0 1A3C8226 6EC8B7E1 55DF83B8 4A85BA36 76A52A40 278A6658
8A630B52 1C95B216 FE9A7CC3 A9393AAB CEC76AF1 96983EA2 57A721AD 7B34D746
4EF92844 FFA2ABF0 46E88E48 7F2BD4FE D6FF1666 A7305664 82127826 97615B40
262173FE 03C75FCB 89A0CB34 E17F33CB C37021BB B9EC10F4 33C556BC 40DD562B
CD70B17D F3736F1B AF614249 1D3C1944 DBEC101B CD9A44BB 044595A6 67B97541
85631A15 5CCFDBBD F9BA44A6 458E585F EDE279DC BDFB4252 FABC2925 2FA13F4A
466ECE7F 35832216 FCAF26A9 81431984 F327DC8A E24DE0C1 26E6098C 827BF6F0
3475D9E7 43321F7E 6A3CFBD5 045CBF9F E5402137 05AE0C77 02030100 01A381DF
3081DC30 09060355 1D130402 3000302C 06096086 480186F8 42010D04 1F161D4F
70656E53 534C2047 656E6572 61746564 20436572 74696669 63617465 301D0603
551D0E04 1604141D 6BCA5313 5483C2D2 3174EF6D 4E4984DC 27815E30 1F060355
1D230418 30168014 A82D5098 9F656D45 F5CE357D 2E42EBAC 29EBFF00 302A0603
551D1F04 23302130 1FA01DA0 1B861968 7474703A 2F2F3139 322E3136 382E342E
3130343A 38303830 30350608 2B060105 05070101 04293027 30250608 2B060105
05073001 86196874 74703A2F 2F313932 2E313638 2E342E31 30343A38 30383030
0D06092A 864886F7 0D010105 05000382 0101005E AC863E65 F8D79A7A BA7C7487
46BC088D 7E1258E2 E5BCA564 5C00EB24 1BD9D596 63699A89 55168389 9D539BED
FA8262E3 0F815E7F 247BC37B 29482BBE 9B491C83 5608F46D E01C3DDC 05524BB9
33E9B24D BF1E2428 B719FF9A 714A0D64 78431A46 53A49009 A8A421C1 0D1A069A
B1B18D1B DBBE900D 98C8EE3B 9B2973EE 4E8993F3 97703F91 6F05F7EE 69436DBD
72998F37 AD454795 76015884 E2E634B6 EDC1D7F0 12725682 D52CAD1F 72F6CD45
5ED20D7B 7FB36364 7631B39F F71F73BE DDE0E708 FC709E80 793E60FE F4F3B178
A7C8384D A42A9729 18E0AABB 704F98E3 D2446963 79355C47 D16B5E91 D14740B4
5F6B1668 415E3669 397FB43A F793471E 498068
quit
ip cef
no ipv6 cef
multilink bundle-name authenticated
license udi pid C881-K9 sn FTX190485K6
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
switchport access vlan 104
no ip address
interface FastEthernet3
no ip address
interface FastEthernet4
no ip address
shutdown
duplex auto
speed auto
interface Vlan1
no ip address
interface Vlan104
ip address 192.168.4.1 255.255.255.0
ip forward-protocol nd
no ip http server
no ip http secure-server
control-plane
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
mgcp profile default
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
login
transport input all
scheduler allocate 20000 1000
end
reda#
help?

Hi Wolfgang,
yes, we solved the problem indeed.
The solution for us was to upgrade the portal to the following releases:
sap.com SAP_ESS 603 SP2
sap.com SAPPCUI_GP 603 SP2
sap.com BP_ERP5ESS 1.31 SP2
I believe that these releases must be used when you have EhP3 in the HR backend.
Hope this will help you too.
Alex

Similar Messages

Certificate request not working with web server v2 template on windows 2012 R2

I have tried to generate a certificate request on my domain joined Windows 2012 R2. I have tried both online and offline requests. I am using the web server v2 template.
Both Method fails with error message that the cryptographic algorithm is unknown. I am using these settings apart from the template:
This is the error Message in online request:
The error Message in the offline request is somewhat similar.
An event error is also appearing in the application log:
The CSPs from the template:
I am wondering if a cryptographic service provider or several of them are missing? They are installed With Windows update are they not? The strange thing is that this supposedly have worked before with another user. Could it be that I do not have the
correct permissions to request a certificate with this template, or has something happened with the server?

Hey dag
Thanks for posting ,
If You try duplicate the web template for using it in version 4 - can You see any difference?
Also check the link below for certificate templates versions:
http://social.technet.microsoft.com/wiki/contents/articles/13303.windows-server-2012-certificate-template-versions-and-options.aspx#Version_4_Certificate_Templates
In previous operating system versions the configuration of CSPs and KSPs were on different tabs in the certificate properties. For version 2 certificate templates, CSPs were configured on the Request Handling tab. For version 3 certificate templates,
KSPs were configured on the Cryptography tab. Starting in Windows Server 2012, the configuration of the providers is consolidated on the Cryptography tab. To learn more about the cryptographic provider options present in previous operating systems
Notice later.
I'd be glad to answer any question

'Get All New Data Request by Request' option not working Between DSO n Cube

Hi BI's..
Could anyone please tell me why the option ' Get one Request only' and 'Get All New Data Request by Request' is not working in DTP between Standard DSO and InfoCube.
Scenario:
I have done the data load by Yearwise say FY 2000 to FY 2009 in Infopackage and load it to Write-optimised DSO (10 requests) and again load Request by request to Standard DSO and activate each request. I have selected the option in DTP's to 'Get All New Data Request by Request' and its working fine between WDSO and SDSO. But not working between Cube and SDSO. While Execute DTP its taking as a single request from SDSO to Cube.( 10 request to single request).
Regards,
Sari.

Hi,
How does your DTP setting looks like from below options ? It should be change log, assuming you are not deleting change log data.
Delta Init. Extraction from...
- Active Table (with archive)
- Active Table (without archive)
- Archive ( full extraction only)
- Change Log
Also if you want to enable deltas, please do not delete change log. That could create issue while further update from DSO.
Hope that helps.
Regards
Mr Kapadia
*Assigning points is the way to say thanks*

I have a problem with wifi in my iphone 4s, i already try everything and download latest version 7.1(11D167) but wifi switch is not working, its my humble request to Apple support team that pls resolve this problem as soon as possible because

I have a problem with wifi in my iphone 4s, i already try everything and download latest version 7.1(11D167) but wifi switch is not working, its my humble request to Apple support team that pls resolve this problem as soon as possible because its a prestiage of Apple Company.
Pls inform me how can i resolve the problem of wifi.

You have to go to autherized iPhone agent.

I am trying to open a service request and the site does not work.

I am trying to open a service request and the site does not work with ANY browser. I get the page https://getsupport.apple.com/GetParts.action which says "Send in for service. We just need a little more information." The continue button does not work. I've seen this problem before trying to file support requests. It's as if Apple simply does not want you to create requests.

I just went through several screens and had no problems. Try clearing your browser's cache and/or history.

I bought the Keynote app for my MacBook, but when I open the application and try to install it, I get an error message saying that the application will not work with my MacBook. What gives? And, can I please request a refund? ($19.99 = a week's groceries)

I bought the Keynote app for my MacBook, but when I open the application and try to install it, I get an error message saying that the application will not work with my MacBook. What gives? And, can I please request a refund? ($19.99 = a week's groceries).
Thank you for your help! - I did try looking for all available specs about Keynote on the Apple iTunes website, and found nothing that could help me. HELP!

1
Close all iWork applications
2
Uninstall Keynote; this must be done with an application remover tool to delete the installation properly. Appcleaner is known to work correctly for this purpose, it is free and can be downloaded from here: Appcleaner Download
3
empty the trash
4
shutdown the Mac and restart. After the start up chime, hold down the shift key until the apple logo appears
let the Mac complete the start up procedure completely, it will take longer than usual as the hard drive is being repaired
5
Reinstall Keynote by logging into the Mac App Store using download / install

HT201413 Device does not work when I connect it to your computer to the iTunes program update requests and then gives me an error No. 21

Device does not work when I connect it to your computer to the iTunes program update requests and then gives me an error No. 21

Device does not work when I connect it to my computer to the iTunes program update requests and then gives me an error No. 21

I want to reset my privacy questions for my apple i.d. But when i request to do so it sends it to a email address that isnt on my file can anyone tell me why its not working?

I want to reset my privacy questions for my apple i.d. But when i request to do so it sends it to a email address that isnt on my file can anyone tell me why its not working?

1) Apple ID: All about Apple ID security questions
Torrifromny wrote:
I want to reset my privacy questions for my apple i.d. But when i request to do so it sends it to a email address that isnt on my file ?
2) See Here. Apple ID: Contacting Apple for help with Apple ID account security
Ask to speak with the Account Security Team...
3) Or Email Here > Apple Support iTunes Store Contact

The search function in the itunes store does not work. It will accept a request and suggest searches but then it locks up and will not search. Clicking on the magnifying glass or a suggested search does nothing. Re-installing itunes has not helped.

The search function in the itunes store does not work. It will accept a request and suggest searches but then it locks up and will not search. Clicking on the magnifying glass or a suggested search does nothing. Re-installing itunes has not helped.

everything you stated here is exactly what i have done and have got nowhere. i have windows 7 64 bit on a hp 8 g of ram desktop. im also looking for help

Action link not working in Direct db request(OBIEE 11g)

Hi all ,
My Requirement.. is...
From direct db request .. i need to navigate to detail report and it should be display the results(detail report results) based on the value,which user click's on the summary report.
For the above requirement ..
I have done below steps..
Summary report(Direct db request) columns:
   Diet no,diet name
   a.I have created a action link on diet no column.
Detail report columns:
   Diet No ,Diet Name,Material Name
   a. I have set diet no as is prompted
when i click on the diet no value in summary report ,we are able to navigate to detail report but it's not filtered based upon diet no value , which i have clicked in summary report.
It is displaying all results(detail report).
Note: if both are normal reports(not direct db request) it's working fine.
If one of the report is direct db request..Action link is not working properly.
Is it action link working in direct db request.........or not
If any one having any ideas pls share me ..
Regards,
Bharath

Hi,
It's known bug. this issue fixed in 11.1.1.7.0 (coming soon).
bug 13852263 - ACTION LINKS - NAVIGATION TO BI REPORTS DOESN'T WORK ( OPEN IN NEW WINDOW)
for now : to uncheck the "Open in New Window" checkbox and go to the detail report in the same Window.
Note: this bug has been fixed by applying the patch 14003822 (u need to get the latest patch)
Thanks
Deva
Edited by: Devarasu R on Feb 14, 2013 4:05 PM

ALSB 3.0 : Request message works in Test Console but not from Client side

By invoking a Web Service operation through a signature/encryption enabled Proxy Service in the ALSB Test Console for Proxy Services, i get a successful response.
Now when invoking the operation from a client application i get the following error response:
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
<env:Header/>
<env:Body>
<env:Fault xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<faultcode>wsse:FailedCheck</faultcode>
<faultstring>weblogic.xml.crypto.encrypt.api.XMLEncryptionException: Unable to resolve encryption key for weblogic.xml.crypto.encrypt.api.EncryptedType{keyInfo=null, cipherData=CipherValue: zDeM4MKI8OeFzgJAR+z16ZE3cUfw54DtMKojPNACkVVZM0hazes+DcI4rJIHWzgt5N259pi9WTKgSEgBxQLZ3qD6PycrwTZuQ/4g2JbBwLwbO9WS40NsIhZRQCtguFPG8vKwNWeoXMOZ5w0m3jhV2ahFWZCTAipoG4XIOv/7pEw=, id='Enc-6abda982-1678-4774-97f3-cada98d32869', mimeType='null', encoding='null', encryptionMethod=EncryptionMethod: algorithm = http://www.w3.org/2001/04/xmlenc#aes256-cbc;}</faultstring>
</env:Fault>
</env:Body>
</env:Envelope>
Even when pasting the original request from the Test Console in ALSB into "soapUI" and executing the request it does not work:
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
<env:Header/>
<env:Body>
<env:Fault xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<faultcode>wsse:InvalidSecurity</faultcode>
<faultstring>Could not validate encryption against any of the supported token types</faultstring>
</env:Fault>
</env:Body>
</env:Envelope>
So what's behind all this? Why does it work in the test console but never from other points.

In both ways, with Direct Call option selected or deselected, the behaviour is the same.
I cannot explain, why the replay of the request does not work from outside the Service Bus. Is there some sort of unique data mixed into the CipherValue data or something like that?

Request to post Icloud not working locations. for 2 days almost from Ventura CA. I think they are not being truthful about th eamount of folks affected!

request to post Icloud not working locations. for 2 days almost from Ventura CA. I think they are not being truthful about the percentage of folks affected!
and what's with the minimalist response? We're working on it for 2 days? You can do beter than that for exsisting loyal customers can't you?

I just spoke to a Support person with Apple. I got the same answer, "We Don't Know", "but they are working on it...Blah, Blah. I too live in Ventura, and have been without email since yesterday approx. 3:00 pm.
The guy said, it's the same if you brought your computer into the shop. We have to determine if it's hardware, or software, then fix the problem.
Well, What about a BACK UP SERVER? No real answer to that one. Just, "Thanks, for your Patience."
This really blows!!!

GRC 10.0: Access Request Creation - LDAP user advanced search not working

Dear Experts,
We are implementing SAP GRC Access Control and we have an issue in Access Request Creation. If we put the user name in “User” field and press intro, the user details are updated, but if we want to make an "Advanced search" the user is not found and the application give us the following message: “No records found for the search criteria entered.”
Scenario 1: If we put the user name in “User” field and press intro, the user details are updated:
Scenario 2: If we want to make an "Advanced search" the user is not found and the application give us the following message: “No records found for the search criteria entered.”
We are using the Active Directory as Data Source.
Thanks and Regards.

Hi Jose,
Try maintaning the parameter 2050 as YES and check once.
Kindly, also make refer to the below list of SAP notes:
1757906 - GRC 10.0 - LDAP user search does not work in NWBC
1745370 - LDAP search in GRC does not work anonymously
1718242- UAM: User search not working in Access Request.
Regards,
Neeraj Agarwal

ESS/MSS: Approve Leave Request in UWL - not working

Hi to all,
we are using web dynpro ESS/ MSS (SAPESS07_12/ SAPMSS07_4) in portal NW04s for mySAP ERP2005 and are using UWL in order to approve leave requests. If employees are creating leave requests, everything works fine. After that the manager opens the leave request in UWL, the web dynpro application is openening succesfully and after some clicks he reaches the buttons to approve or reject the leave request. But by pushing one of them the following messages occures :
Workitem 000000000000 Cannot be read
After pushing the button again, another message comes up:
No Customizing for status typ ARQ, Status approved...
By the way, the same errors also come up when the employee wants to delete his leave request which is not approved.
Any ideas, what can be the reason?
Regards,
Frank

Hi Ashutosh,
I have found the reason. The user WF - Batch in sap erp, which is using the RFC Destination for workflow, was locked. Well, it is a a little bit strange for a cummunication user that he becomes locked. Unlocked him, now all works.
Thanks for your support.
Regards,
Frank

Rotate tool not working in cs6. It says "Could not complete your request because it only works with OpenGL enabled document windows." Its worked fine in the past....

Rotate tool not working in cs6. It says "Could not complete your request because it only works with OpenGL enabled document windows." Its worked fine in the past....
-CharlieH23

Copy and paste only this area, you may have to scroll down.
Adobe Photoshop Version: 13.1.2 (13.1.2 20130105.r.224 2013/01/05:23:00:00) x64
Operating System: Windows 7 64-bit
Version: 6.1 Service Pack 1
System architecture: Intel CPU Family:6, Model:10, Stepping:9 with MMX, SSE Integer, SSE FP, SSE2, SSE3, SSE4.1, SSE4.2, HyperThreading
Physical processor count: 2
Logical processor count: 4
Processor speed: 2494 MHz
Built-in memory: 6019 MB
Free memory: 3360 MB
Memory available to Photoshop: 5227 MB
Memory used by Photoshop: 60 %
Image tile size: 128K
Image cache levels: 4
OpenGL Drawing: Enabled.
OpenGL Drawing Mode: Advanced
OpenGL Allow Normal Mode: True.
OpenGL Allow Advanced Mode: True.
OpenGL Allow Old GPUs: Not Detected.
OpenCL Version: 1.2
OpenGL Version: 2.1
Video Rect Texture Size: 16384
OpenGL Memory: 2112 MB
Video Card Vendor: Intel
Video Card Renderer: Intel(R) HD Graphics 4000
Display: 1
Display Bounds: top=0, left=0, bottom=768, right=1366
Video Card Number: 1
Video Card: Intel(R) HD Graphics 4000
Driver Version: 10.18.10.3958
Driver Date: 20140930000000.000000-000
Video Card Driver: igdumdim64.dll,igd10iumd64.dll,igd10iumd64.dll,igdumdim32,igd10iumd32,igd10iumd32
Video Mode: 1366 x 768 x 4294967296 colors
Video Card Caption: Intel(R) HD Graphics 4000
Video Card Memory: 2112 MB

OSCP CRL request not working!!!

Similar Messages

Maybe you are looking for