RCM not generating new Delta CRLs
Originally Published: 2012-03-06
Last Modified: 2023-10-06
Article Number
000060689
Applies To
RSA Certificate Manager 6.8
RSA Certificate Manager (RCM)

Windows 2008 Server R2 x64
Issue
RCM  not generating new Delta CRLs
not generating new CRLs, caused a system outage
The timers were updated last Friday to the following:
RL Type CA Nickname CA md5 Period Start Time Next Update Buffer
 
CRL Internal CA
99cb44c903901afe04b844ca77694892 252900 - 43200

DCRL Internal CA
99cb44c903901afe04b844ca77694892 86400 - 14400

The services were restarted yesterday at 8:30AM EST which created new crl files. The delta was set to expire at 1:23 PM today. Given the timers that were set, expected a new delta crl at 8:30 AM this morning. As of 1:23 PM EST today, the same crl files that were generated yesterday morning were still showing up on the certificate manager. It appears as if it did not generate a new delta CR this morning.


Cause
From the trace log, the dcrl timer is reset at 9:30. At 8:30, a full CRL and delta CRL is generated during full CRL generation. Since the timer is reset, the delta CRL is skipped at 9:30.
Resolution
Fix is part of RCM 6.8 build 521 or higher. Contact RSA Customer support if you need additional information.
Notes
CERTMGR-4020
Don't see what you're looking for?