What causes the SAN mismatch error that prevents the system from fetching the CRL?

The SAN mismatch error may occur when you are enabling the CRL information. This error indicates that the IP or host name does not match the value of the SAN in the web certificate. To avoid getting this error, use the FQDN in the path of the CRL instead of the IP. You can also configure the web certificate and use the FQDN of your system in the SAN field.

Why are the ca‑signer‑1 and vault‑1 tokens offline?

If the System Status page shows that your ca‑signer‑1 and vault‑1 tokens are offline, then do the following:

1. In /etc/openxpki/config.d/realm/realm name/crypto.yaml, change the corresponding key value.



2. Restart the OpenXPKI service.