I work for a service provider company and helped out one of my colleagues today who had trouble with getting a newly installed C896VA-K9 router (running IOS 15.4) to authenticate with our public CA server via the internet. That is when I witnessed something very weird and illogical. I hope someone can make some sense of this...
So I SSH'd to the box, did a couple show commands and saw that the configuration was OK, the RSA key pair was in place and the trustpoint configured:
My_Router#sh crypto pki trustpoint status
Trustpoint MY_TRUSTPOINT:
Issuing CA certificate not configured.
Next enrollment attempt:
12 seconds
* A new key will be generated *
* Configuration will not be saved after enrollment *
State:
Keys generated ............. Yes (General Purpose, non-exportable)
Issuing CA authenticated ....... No
Certificate request(s) ..... None
The fact that the router did not authenticate the issuing CA yet was already unusual, as the router is configured with an event manager that automatically authenticates the CA, once NTP becomes synchronized.
When trying to manually authenticate the CA server with the command (config)#crypto pki authenticate MY_TRUSTPOINT, the waiting period was unusually long, and eventually the router returned the following syslog message:
%PKI-6-CERTRENEWAUTO: Renewing the router certificate for trustpoint MY_TRUSTPOINT
%PKI-3-SOCKETSELECT: Failed to select the socket.
I gave it several tries, but without luck. I even erased the trustpoint and configured it again, but the authentication kept failing. Then I did a "debug crypto pki transactions" to see what exactly happens in the background, and tried to authenticate once again. Strangely, this time the authentication was successful! After it I quickly enrolled and finally received my certificate from the CA.
I found it strange that after issuing a simple debug command the authentication succeeded, so I did it again from the start. I erased the trustpoint and the RSA key pair, and configured them once more. I tried to authenticate with the debug turned off; it didn't work. Then I turned the debug on and the authentication was successful!
I cannot figure out what happened there, because the whole thing does not make any sense for me.
The only thing that diverged from the default setting was the config register, which was set to 0x101 instead of 0x2102.
Might it be the cause of this weird behavior?
Any kind of help/information is much appreciated!
