HP FlexFabric 5700 series User Manual

246
• The LDAP server is not configured or is incorrectly configured.
• No key pair is specified for the PKI domain for certificate request, or the specified key pair does not
match the local certificates to the obtained.
• The PKI domain does not reference the PKI entity configuration, or the PKI entity configuration is
incorrect.
• CRL checking is enabled, but CRLs do not exist locally or CRLs cannot be obtained.
• The CA server does not accept the source IP address specified in the PKI domain, or the source IP
address is incorrect.
• The system time of the device is not synchronized with the CA server.
Solution
1. Check for and fix any network connection problems.
2. Obtain or import the CA certificate.
3. Configure the correct LDAP server.
4. Specify the key pair used for certificate request in the PKI domain, or remove the existing key pair
and submit a certificate request again.
5. Check the registration policy on the CR or RA, and make sure the attributes of the PKI entity meet
the policy requirements.
6. Obtain the CRL from the CRL repository.
7. Specify the correct source IP address that the CA server can accept. For the correct settings,
contact the CA administrator.
8. Synchronize the system time of the device with the CA server.
9. If the problem persists, contact HP Support.
Failed to request local certificates
Symptom
Local certificate requests cannot be submitted.
Analysis
• The network connection is down, for example, because the network cable is damaged or the
connectors have bad contact.
• No CA certificate has been obtained before you submit the certificate request.
• The certificate request URL is incorrect or is not specified.
• The certificate request reception authority is incorrect or is not specified.
• The required parameters are not configured for the PKI entity or are mistakenly configured.
• No key pair is specified for the PKI domain for certificate request, or the key pair is changed during
a certificate request process.
• Exclusive certificate request applications are running in the PKI domain.
• The PKI domain is not specified with the source IP address of the PKI protocol packets that the CA
server can accept, or is specified with an incorrect one.
• The system time of the device is not synchronized with the CA server.

HP FlexFabric 5700 series Specifications

General

Layer Support	L2/L3
Routing Protocol	OSPF, BGP, RIP, IS-IS, Static Routing
Remote Management Protocol	SNMP, CLI, Web
Features	VXLAN
Compliant Standards	IEEE 802.1D, 802.1Q, 802.1w, 802.1s, 802.3ad
Operating Temperature	0°C to 45°C
Operating Humidity	10% to 90% (non-condensing)
VLANs	4K