VPN Certificate CRL issues

[shawnmchenry]

We're trying to implement certificates on our VPN 3060s. I can get it working great until I enable CRL checking. According to the log, the concentrator sucessfully retrieves the CRL.

I get the following errors:

1381 12/29/2004 11:17:19.670 SEV=3 CAPI/25 RPT=6 CAPI - Invalid RSA PKCS1 decryption payload length (256) provided

1386 12/29/2004 11:17:19.680 SEV=4 IKE/80 RPT=45 192.168.1.1 Group [Corporate] Certificate validation failure, Invalid CRL signature

I have an open case with Cisco and am awaiting a response from them.

Has anyone else see this issue?

Shawn

[pradeepde]

Did you try revoking a cert to see if it helps?

[shawnmchenry]

Yes we did. The CRL version number increments and we still have the same error. At this point it's in the hands of the developers at Cisco to figure it out.