Unable to renew certificate from web enrollment server
2 years ago
Originally Published: 2013-12-26
Article Number
000040109
Applies To
RSA Certificate Manager 6.9 build 554
Issue
Unable to renew certificate from web enrollment server.

When trying to browse to the web enrollment server page there is the general Internet Explorer error:

"The Page Cannot Be Displayed"
The renewal-cipher.log shows:

[Mon Oct 07 10:03:36 2013] [error] [client 192.168.170.154] Certificate Verification: Error (10): certificate has expired
[Mon Oct 07 10:03:36 2013] [debug] ssl_engine_kernel.c(1896): SSL-C: Write: SSLv3 read client certificate B
[Mon Oct 07 10:03:36 2013] [debug] ssl_engine_kernel.c(1915): SSL-C: Exit: error in SSLv3 read client certificate B
[Mon Oct 07 10:03:36 2013] [debug] ssl_engine_kernel.c(1915): SSL-C: Exit: error in SSLv3 read client certificate B
[Mon Oct 07 10:03:36 2013] [info] [client 192.168.170.154] SSL library error 1 in handshake (server test.xxxxxx.com:1448)
[Mon Oct 07 10:03:36 2013] [info] SSL Library Error: 336105650 error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
[Mon Oct 07 10:03:36 2013] [info] [client 192.168.170.154] Connection closed to child 29 with abortive shutdown (server test.xxxxxx.com:1448)

Resolution
To resolve:

1) Open the file <install-dir>/WebServer/httpd.conf using a text editor
2) Under "RSA Renewal Server configuration" virtual host section, search for "SSLIgnoreExpiryCheck" directive
3) Set the value of SSLIgnoreExpiryCheck to "on" as follows:
    SSLIgnoreExpiryCheck on
4) Restart RCM services