How a host's CRL affects certificate revocation troubleshooting

Each NetBackup host obtains a fresh certificate revocation list periodically. When a host's certification revocation list is up-to-date, job failure messages and status codes are accurate and dependable. Likewise, NetBackup audit messages are accurate and dependable.

However, if the CRL is not up-to-date, job failures may appear as network errors. You may need to examine more than the NetBackup job details and command output to isolate the error.

In this context, up-to-date means that the CRL contains all NetBackup hosts that have a revoked certificate. A NetBackup host's CRL may not be as new as the CRL on the master server. However, if no hosts were revoked since it acquired the CRL, the CRL is up-to-date.

The CRL on the master server is generated every 60 minutes or within 5 minutes of a revocation. Conversely, the interval at which other NetBackup hosts request a new CRL from the master server may be longer. Each NetBackup host learns about new certificate revocations only when its CRL is refreshed.

The Security level for certificate deployment setting determines the CRL refresh interval for all NetBackup hosts. Although all NetBackup hosts update their CRLs on the same time interval, when each host requests a new CRL varies.

Verify the security settings under Security Management in the NetBackup Administration Console.

For more information about CRLs and the global security settings, see the NetBackup Security and Encryption Guide.