Hello
I have a VPN 3005 concentrator, running image version 4.1.7.F
A Windows 2000 Server is configured as CA with SCEP. Cisco routers and firewalls can authenticate the CA, enroll, request and retrieve certificates using SCEP. The CA is reachable via URL http://x.x.x.x/certsrv/mscep/mscep.dll . The CA was configured without password.
All seemed to work well, until I connect the VPN 3000 concentrator
The CA is installed on the public side of the concentrator. I want to install a certificate for CA via SCEP (menu: Admin, Certificate Management, Enroll). The operation fails with this message
“An error has occurred while attempting to perform the operation. Error retrieving certificates: Invalid HTTP response.”
Just to make sure the filter applied to outside interface does not stop traffic, I applied the default Private filter (permit any in and out) to the public interface.
The CA authentication continues to fail.
Syslog messages
1 12/04/2005 18:53:26.300 SEV=7 CLIENT/28 RPT=2
CLIENT_InitiateRequest(66f1c78, 3)
2 12/04/2005 18:53:26.300 SEV=7 CLIENT/29 RPT=2
CLIENT_BuildReq(66f1c78, 3)
3 12/04/2005 18:53:26.300 SEV=7 CLIENT/37 RPT=2
CLIENT_OpenFilter(66f1c78, 3)
4 12/04/2005 18:53:26.300 SEV=7 CLIENT/30 RPT=2
CLIENT_SendReq(66f1c78, 3)
5 12/04/2005 18:53:26.300 SEV=9 CLIENT/21 RPT=2
HTTP client sending GET /certsrv/mscep/mscep.dll?operation=GetCACert HTTP/1.0
6 12/04/2005 18:53:26.500 SEV=7 CLIENT/31 RPT=15
CLIENT_RcvResp(66f1c78, 3)
7 12/04/2005 18:53:26.500 SEV=8 CLIENT/18 RPT=1
Waiting for remainder of HTTP header
8 12/04/2005 18:53:26.500 SEV=7 CLIENT/33 RPT=15
CLIENT_ProcSvrData(66f1c78, 3)
9 12/04/2005 18:53:26.500 SEV=9 CLIENT/24 RPT=15
Number of bytes still needed: unknown
10 12/04/2005 18:53:36.300 SEV=7 CLIENT/32 RPT=1
CLIENT_Timeout(66f1c78, 3)
11 12/04/2005 18:53:36.300 SEV=4 CLIENT/7 RPT=3
Transaction timed out
12 12/04/2005 18:53:36.300 SEV=7 CLIENT/34 RPT=2
CLIENT_BuildResponse(66f1c78, 3)
13 12/04/2005 18:53:36.300 SEV=7 CLIENT/35 RPT=2
CLIENT_Callback(66f1c78, 3)
14 12/04/2005 18:53:36.300 SEV=4 CERT/73 RPT=4
An error occurred during the transport of the SCEP message via HTTP.
See the CLIENT event class for more information.
16 12/04/2005 18:53:36.310 SEV=7 CLIENT/36 RPT=2
CLIENT_Cleanup(66f1c78, 3)
An Ethereal capture taken on the CA server shows the VPN opening an HTTP session, and trying to “GET /certsrv/mscep/mscep.dll?operation=GetCACert HTTP/1.0”. The CA server responds with a TCP FIN.
I wonder if somebody had similar problems.
Thank you,
Cristian
