question about a debug output (CA)

[nvanhaute]

hi all,

Since I upgraded some of my ISR 3825 by ISR G2 3925e (VPN env) IOS 15.1(4)M, I have this output in log each day :

CRYPTO_PKI: Failed to find ca req pool entry X

I use VPN with x509 certificates + CRL (ldap)

if you have an idea

Regards

Nicolas

[Marcin Latosiewicz]

Nicolas,

Can I suggest to open up a TAC case? This check as far as I see was introduced in 15.x trains only.

To make things faster enable following debugs before the message is printed:

debug crypto pki mess
debug crypto pki trans
debug crypto pki valid
debug cry pki call

This could be a minor bug or some misconfig, hard to say without view of full config.

Marcin

[nvanhaute]

hi Marcin,

ok np, I will check with TAC in giving all debugs.

Thanks

Nicolas