Getting OCSP response "unkown" after importing 'sign' certificate

[bmalila]

Hi,
I am setting up a new X-Road instance using the configuration manuals. I am having a problem when it comes to registering certificates. After importing the certificate, the OCSP response is unknown, instead of 'Good'. When we try to do a registration request for 'auth', we get failure message "Failed to register certificate: Member: Dev/Edu/911" has no suitable certificate.

[petkivim]

Hi @bmalila

What does your Security Server's diagnostics view say? If it shows red for the OCSP responder, please take a look at the /var/log/xroad/signer.log log file.

You can also try to empty the OCSP cache by following these instructions.

Regards,
Petteri

[AWfaw]

Hi @petkivim

Yes your are right, The OCSP responder is read and shows that test-ca.lxd:8888 is unable to connect to the OSCP responder. Also the time-stamping is read with message that test-ca:lxd:8899 having the internal error.

[petkivim]

Hi @AWfaw

That explains the problem. Have you tried to restart the test-ca container and/ or OCSP + TSA services running inside of it? Instructions for restarting the services can be found at:

https://github.com/nordic-institute/X-Road/blob/develop/ansible/TESTCA.md#4-restart-nginx-ocsp-and-tsa-services

Regards,
Petteri

[petkivim]

If restarting the container or the services does not help, try to use the internal IP address of the test-ca container in the X-Road configuration instead of test-ca.lxd DNS name. Please note, that after updating the TSA URL on the Central Server, you must first remove the TSA configuration on the Security Server and then add the TSA again to apply the new TSA URL.

[AWfaw]

@petkivim
Thanks, yours second recommendation helped me lot. Right now the OCSP response from SIGN has a status "good" and AUTH in status "registration in progress"

[petkivim]

@AWfaw
That's great! Next you must complete the steps described in section 3.6:

https://confluence.niis.org/pages/viewpage.action?pageId=6783483#HowtoConfigureCentralServer?-3.6Registeringtheauthenticationcertificate

Please note, that some of the steps must be completed on the Central Server, not on the Security Server.

[AWfaw]

@petkivim

Okay, I'm in the central server. The AUTH key had been added to the "Owned Servers", but if I going to the "management requests" the certificate registration has a status "waiting" not "submitted or approved".

[petkivim]

@AWfaw

Are there one or two requests in the management requests queue on the Central Server? And are you sure that you imported the auth certificate (not sign certificate or auth key - as you wrote above)?

[AWfaw]

@petkivim

I checked twice the keys. It seems like something was wrong with AUTH key. I deleted a key and generated a new one. At the following moment it works.