Pular para o conteúdo principal

Troubleshooting LAPP

A LAPP failure never stops a validation by itself: when LAPP cannot help, the PKI SDK goes on as if LAPP were disabled, and the validation ends the way it would without LAPP, usually with the revocation status unknown (in PKI Express, the CertificateRevocationStatusUnknown code). Go through the checks below in order. Where a check mentions the PKI SDK log, it is the log of the PKI SDK inside your product, when logging is on.

1. The setting is on​

Check that the product's LAPP setting is true and that the service was restarted afterwards. See Enabling LAPP. In the PKI SDK, PkiConfig.LappEnabled must be set in the same process that validates the certificates.

2. The server can reach LAPP​

From the server, run:

curl http://lapp-fx-brs.lacunasoftware.com/api/system/info

A JSON answer with "name":"Lacuna.Lapp.Function" means the network is fine. If the call fails or times out, allow outbound HTTP (TCP port 80) to lapp-fx-brs.lacunasoftware.com on the firewall. If the server goes out through a proxy, run curl with --proxy and check that the product's proxy setting is the same one.

3. Your license is authorized​

LAPP answers requests from a license it has not authorized with 422 Unprocessable Entity and the message Not authorized request (<license ID>): <licensee>. The PKI SDK log records the answer as an error:

HTTP error (Unprocessable Entity): Not authorized request (<license ID>): <licensee>

If you have just enabled LAPP, contact support and confirm that they have authorized LAPP for your license. Tell them the licensee name of the PKI SDK license the server uses. If you renewed or replaced the license, the new license ID may need to be authorized too, unless the licensee name is the same.

4. The timeouts are long enough​

The PKI SDK only asks LAPP after the download from the CA's URL fails. If the firewall drops the packets to the CA's URL instead of rejecting them, the SDK first waits for the whole download timeout, then sends the request to LAPP with the same timeout. When the whole operation has a time limit of its own (an HTTP request to your application, for example), it may run out before LAPP answers.

  • Configure the firewall to reject the connections it blocks, so the direct download fails at once.
  • In the PKI SDK, review PkiConfig.CrlDownloadTimeout and PkiConfig.CAIssuersDownloadTimeout.

5. LAPP can download the file​

LAPP downloads CRLs and CA certificates from the same URLs your server would use. If the CA's server is down for everyone, or the URL in the certificate is wrong, LAPP cannot get the file either, unless it already holds a copy of that CRL that is still valid. LAPP then answers 422 too, and the PKI SDK log shows HTTP error (Unprocessable Entity): followed by a message such as Could not find CRL (...) for issuer ... or Crl entity not found for uri: ....

To tell this case apart from the others, try to download the CRL from a computer outside your network, using the URL in the certificate's CRL Distribution Points extension. If that fails too, the problem is on the CA's side: wait for the CA to fix it or contact the CA. If it works there, send support the certificate and the time of the failed validation.

See also​

View as Markdown