NetBackup status code: 9126
Message: The remote server's certificate is not valid or doesn't exist.
Explanation: The remote server's certificate is invalid or doesn't exist. Multiple issues can cause this error.
Recommended Action: Perform the following as appropriate:
The table that is shown lists the issue and the associated action that is required to fix the issue:
Review the nbcs/bpfis/bppfi level error messages that are displayed in Job details on the Activity monitor. For more details, review the component logs.
Review the nbwebservice/nbemm level error message for the Snapshot Manager and plug-in configuration. For more details, review the component logs.
Table: Operation failed due to SSL certificate issues or connectivity issues.
Message | Recommended action |
|---|---|
Unable to retrieve the certificate CRL. If you have configured the ECA_CRL_PATH, ensure that valid CRLs are present at the location. Confirm that the CRL URL is accessible from the Snapshot Manager. | Copy the latest CRL into the ECA_CRL_PATH path or ensure that the CRL distribution point URL from the respective host certificate is accessible from the Snapshot Manager. |
The certificate revocation list (CRL) is expired. Ensure that the ECA_CRL_PATH is updated with the latest CRL. | Ensure that the latest CRL's are uploaded at the ECA_CRL_PATH path. The Snapshot Manager CRL cache can be updated manually by using the following command on Snapshot Manager host: flexsnap_configure renew --token token |
The certificate revocation list (CRL) is not yet valid. | Review your Snapshot Manager's system time or provide a valid CRL. |
The date of last update of the certificate revocation list (CRL) is not in a valid format. | Review the CRL using the OpenSSL command or contact your Security Administrator. |
The date of next update of the certificate revocation list (CRL) is not in a valid format. | Review the CRL using the OpenSSL command or contact your Security Administrator. |
The operation has failed with a cURL error. | Perform the operation again. If the problem persists, save all of the error log information and contact Cohesity Technical Support. |
The certificate is revoked. | Determine if any of the certificates in the chain have been revoked or contact your Security Administrator. To renew Snapshot Manager certificate, run the following command on the Snapshot Manager host: For NBCA: flexsnap_configure renew --hostnames FQDN --token token --force For ECA: flexsnap_configure renew --hostnames FQDN --ca ca_file_path --key key_file_path --chain chain_file_path For more details, refer to status code 9318. |
The certificate has expired. | (Not applicable for NBCA) Review the expiration of the certificates or contact your Security Administrator. For ECA, renew the Snapshot Manager certificate manually on Snapshot Manager host using the following command. flexsnap_configure renew --hostnames FQDN --ca ca_file_path --key key_file_path --chain chain_file_path For NBCA, Snapshot Manager certificates are automatically renewed within last 90 days of the expiration period. For more details, refer to status code 8506. |
Other NetBackup error codes or messages can also be referred to for more information of SSL certificate or connectivity issues between primary server and Snapshot Manager. Resolve network issues if any, with netstat or a similar network diagnosis tool. The status of certificates that are issued for Snapshot Manager can be verified using flexsnap_configure serverinfo and health of containers running can be verified using flexsnap_configure status.
Click here to view technical notes and other information on the Cohesity Technical Support website about this status code.