问题描述

现场手工申请pki证书失败，证书服务器与CA服务器类似，连通性测试正常，设备时间确认和服务器时间一致。相关配置如下：

#

pki entity 123123

common-name 123

#

pki domain 1

ca identifier 123123

certificate request url http://119.1.xxx.xxx:30445

certificate request from ca

certificate request entity 123123

certificate request mode auto

public-key rsa general name 123123 length 2048

undo crl check enable

[123]pki request-certificate domain 1password 111111

Start to request certificate ...

Failed to request certificate.

过程分析

deb报错如下：

Start to request certificate ...

.*Jun 27 10:46:06:174 2023 123 PKI/7/PKI_DEBUG: Create the PKCS#10 request successfully.

*Jun 27 10:46:06:182 2023 123 PKI/7/PKI_DEBUG: SCEP: Host: 119.1.xxx.xxx

Port: 30445

Path: .

*Jun 27 10:46:06:183 2023 123 PKI/7/PKI_DEBUG: PKCS#7 envelope: Encrypted payload successfully.

*Jun 27 10:46:06:196 2023 123 PKI/7/PKI_DEBUG: SCEP request message :GET //pkiclient.exe?operation=PKIOperation&message=dsadsdsadsadadadasd12e12efadasdgv2......

...................................................................

Failed to request certificate.

[123]*Jun 27 10:47:14:091 2023123 PKI/7/PKI_DEBUG: epoll wait failed. Reason: Success.

%Jun 27 10:47:14:092 2023 123 PKI/5/REQUEST_CERT_FAIL: Failed to request general certificate of domain 1.

解决方法

怀疑是大包不通，在连接服务器的接口配置tcp mss 1380后正常。