NetBackup status code: 5982
Message: The certificate revocation list (CRL) is unavailable.
Explanation: This error can occur for the following reasons if the NetBackup CA-signed certificate is used for communication:
(Scenario 1) The NetBackup web service has not yet generated a CRL. The NetBackup web service attempts to generate a new CRL on startup. If the CRL has not been generated it means one of two things: The CRL creation is in progress. Or, there was a problem generating the CRL.
(Scenario 2) The host does not have a CRL cached for the current domain.
If an external CA-signed certificate is used for communication.
(Scenario 3) NetBackup is not configured with correct CRL path or certificate does not contain a valid CRL distribution point (CDP).
(Scenario 4) The host does not have a CRL cached in NetBackup CRL cache.
Recommended Action: Do the following, as appropriate:
For Scenario 1, do the following:
Retry the command or operation.
Verify that nbatd is running on the master server, then retry the operation.
Restart the services on the master server, then retry the operation.
On the master server, examine the unified logs on the NetBackup server for nbwebservice (all OIDs).
On the master server and on the host where the error occurred, examine the unified logs for nbatd (OID 18).
For Scenario 2, do the following:
Run the following command for the master server and then retry the operation:
./nbcertcmd -getCrl -server master server name
On all hosts that are involved in the communication, examine the unified logs for nbpxyhelper (OID 486).
On the host where the error occurred, examine the legacy logs for nbcertcmd.
(Scenario 3) NetBackup is not configured with correct CRL path or certificate does not contain a valid CDP.
If the ECA_CRL_PATH setting is specified in the NetBackup configuration file, ensure the following:
The
ECA_CRL_PATHhas the correct CRL directory path.The CRL directory contains CRLs for all required certificate issuers (as per ECA_CRL_CHECK setting).
The CRL is in PEM or DER format.
The CRL is not expired.
The CRL last update date is not a future date.
If the CDP is used, do the following when appropriate:
Make sure that the certificate has at least one CDP (with HTTP/HTTPS protocol) that points to a CRL that includes revocation information for all reasons.
CDP URL is accessible.
(Scenario 4) The host does not have a CRL cached in NetBackup CRL cache.
If
ECA_CRL_PATHsetting is specified in the NetBackup configuration file, run the following command on all hosts that are involved in the communication and retry the operation:./nbcertcmd -updateCRLCacheIf bpclntcmd is running, terminate it (bpclntcmd -terminate) and retry the operation.
Set VERBOSE and ENABLE_NBCURL_VERBOSE (0|1).
Examine the logs for
bpclntcmd.
On all hosts that are involved in the communication, examine the unified logs for
nbpxyhelper(OID 486).On the host where the error occurred, examine the legacy logs for
nbcertcmd.
Click here to view technical notes and other information on the Cohesity Technical Support website about this status code.