8 Troubleshooting
Use /var/log/oclm.log and systemd status output as the first troubleshooting sources.
sudo systemctl status --no-pager oclm-service
sudo tail -n 200 /var/log/oclm.logThe following table provides common checks:
Table 8-1 Common checks
| Symptom | Check |
|---|---|
| Service does not start | Confirm issuerConfig.properties, initial CMP identity files, and required trust files exist and are readable by admusr.
|
| CMP request fails | Confirm cmp.server, cmp.recipientDN, cmp.rootCACerts, TLS settings, network reachability, and Operator CA policy.
|
| API client cannot connect | Confirm TCP 8989 is listening and customer network policy permits access. |
| Certificate validation fails | Confirm system time, Operator CA trust chain, and the initial CMP identity certificate validity period. |