[XrcXUDADUNABLE]: unable to contact directory server
3 years ago
Originally Published: 2003-01-10
Article Number
000056121
Applies To
Keon Certificate Authority 6.5
Keon Key Recovery Module 6.5
Sun Solaris 2.8
nCipher
Issue
[XrcXUDADUNABLE]: unable to contact directory server
An error ([XrcXUDADUNABLE]: unable to contact directory server) was encountered in generating your encryption certificate.  If the cause of the problem is not evident, you will need to contact the administrator of this system to proceed further.
Cause
This problem can be caused by an incompatible mixture of the various options selected for the Certificate Authority, Jurisdiction, and nCipher cardset
Resolution
An important factor to be aware of is that on KCA 6.5 with FIPS Level 3, the encryption certificate is created at the time when it is downloaded. This means that at the time when the certificate is to be downloaded, the CA must have access to its private keys. There are two ways the private keys are going to be accessible:

1. The OCS for the jurisdiction is still active (which means one of the cards in the cardset is still inserted) and the CA is not correctly noticing that it is not supposed to do  "Prompt every time" (see below)

2. The OCS in use has been configured for persistent and the keys previously unlocked

An easy test to confirm if your CA (and its cardset) is correctly configured is to do check the following:

1. Enroll for a certificate
2. Approve it
3. Enroll for another certificate
4. Approve it

Question - how many times did you need to type in your PIN(s) for the OCS? If your answer is more than once, the CA is not configured correctly, as this would mean that at the point in time when the end-user tries to get the CA to create and download the encryption certificate that the CA is not going to have access to its keys (and generates the error message).

For more information, see the solution regarding [XrcXUDADUNABLE]: unable to contact directory server.

Don't see what you're looking for?