Expressway client certificate check error

[asmlicense]

Hello all, I have problem with certificate deployment in Expressway E and C. I upload MS root CA, intermediate CA and client certificates.

When I check client certificate I get the following error:

Invalid: unable to get certificate CRL, please ensure that you have uploaded a CRL for the CA that signed this client certificate.

In CRL managment I uploaded Root CA CRL file and get the following error:

File upload failed: The file provided is not a valid X.509 PEM encoded CRL file.

Thats why SIP is inactive between E and C.

EXP version is 8.6

CUCM is in mixed mode.

Any idea?

[Jaime Valencia · Accepted solution]

Did you download the latest CRL in base 64?

[asmlicense]

I just downloaded it from CA and could not find if it base64 or not? How can I know it?

[Justin Ferello]

asm,

If you open the file using Notepad, if it starts with ----BEGIN CERTIFICATE---- then that is Base64 encoded, anything else is DER encoded.

Thanks,
Justin

[asmlicense]

I have successfully deployed certificates. Secure Traversal Test is Success, but SIP is still inactive. What can be a problem?