• (Scenario 1) The NetBackup web service has not yet generated a CRL. The NetBackup web service attempts to generate a new CRL on startup. If the CRL has not been generated it means one of two things: The CRL creation is in progress. Or, there was a problem generating the CRL.

• (Scenario 2) The host does not have a CRL cached for the current domain.

If an external CA-signed certificate is used for communication.

• (Scenario 3) NetBackup is not configured with correct CRL path or certificate does not contain a valid CRL distribution point (CDP).

• (Scenario 4) The host does not have a CRL cached in NetBackup CRL cache.

For Scenario 1, do the following:

• Retry the command or operation.

• Verify that nbatd is running on the master server, then retry the operation.

• Restart the services on the master server, then retry the operation.

• On the master server, examine the unified logs on the NetBackup server for nbwebservice (all OIDs).

• On the master server and on the host where the error occurred, examine the unified logs for nbatd (OID 18).

For Scenario 2, do the following:

• Run the following command for the master server and then retry the operation:

  ./nbcertcmd -getCrl -server master server name

• On all hosts that are involved in the communication, examine the unified logs for nbpxyhelper (OID 486).

• On the host where the error occurred, examine the legacy logs for nbcertcmd.

• (Scenario 3) NetBackup is not configured with correct CRL path or certificate does not contain a valid CDP.

  • If the ECA_CRL_PATH setting is specified in the NetBackup configuration file, ensure the following:

    • The ECA_CRL_PATH has the correct CRL directory path.

    • The CRL directory contains CRLs for all required certificate issuers (as per ECA_CRL_CHECK setting).

    • The CRL is in PEM or DER format.

    • The CRL is not expired.

    • The CRL last update date is not a future date.

  • If the CDP is used, do the following when appropriate:

    • Make sure that the certificate has at least one CDP (with HTTP/HTTPS protocol) that points to a CRL that includes revocation information for all reasons.

    • CDP URL is accessible.

• (Scenario 4) The host does not have a CRL cached in NetBackup CRL cache.

  • If ECA_CRL_PATH setting is specified in the NetBackup configuration file, run the following command on all hosts that are involved in the communication and retry the operation:

    ./nbcertcmd -updateCRLCache

  • If bpclntcmd is running, terminate it (bpclntcmd -terminate) and retry the operation.

    • Set VERBOSE and ENABLE_NBCURL_VERBOSE (0|1).

    • Examine the logs for bpclntcmd.

  • On all hosts that are involved in the communication, examine the unified logs for nbpxyhelper (OID 486).

  • On the host where the error occurred, examine the legacy logs for nbcertcmd.