How To Fix STRUSTCR026 - Cannot update CRL; issuer not found in source list

SAP Error Message - Details

• Message type: E = Error

• Message class: STRUSTCR - Certificate Revocation Configuration

• Message number: 026

• Message text: Cannot update CRL; issuer not found in source list

What causes this issue?

The certificate revocation check has attempted to find the distribution
point for the CRL by checking the source lists of the CRL profiles for
the issuer of the CRL. No URL was found for the issuer.

System Response

The system cannot update the CRL.

How to fix this error?

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Procedure for System Administrators

Ensure that there is a CRL profile with a URL for the distribution point
of the CRL for the issuer in question.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message STRUSTCR026 - Cannot update CRL; issuer not found in source list ?

  The SAP error message STRUSTCR026: Cannot update CRL; issuer not found in source list typically occurs in the context of managing certificates and Certificate Revocation Lists (CRLs) in the SAP Trust Manager (transaction STRUST). This error indicates that the system is unable to update the CRL because it cannot find the issuer of the certificate in the source list.
  Cause:
  
  Missing Certificate in Source List: The issuer of the certificate for which the CRL is being updated is not present in the source list of trusted certificates.
  Incorrect Configuration: The configuration of the trust relationship may be incorrect, leading to the inability to locate the issuer.
  Expired or Invalid Certificates: The certificates in the source list may be expired or invalid, which can lead to issues when trying to update the CRL.
  
  Solution:
  To resolve the STRUSTCR026 error, follow these steps:
  
  
  Check the Source List:
  
  Go to transaction STRUST in your SAP system.
  Navigate to the SSL Client (Standard) or the relevant trust store.
  Check if the issuer of the certificate is present in the source list. If not, you need to import the issuer's certificate.
  
  
  
  Import the Issuer Certificate:
  
  If the issuer certificate is missing, obtain the issuer's root or intermediate certificate.
  Import the certificate into the appropriate trust store using the Import Certificate function in STRUST.
  
  
  
  Verify Certificate Validity:
  
  Ensure that all certificates in the source list are valid and not expired.
  If any certificates are expired, replace them with valid ones.
  
  
  
  Update CRL:
  
  After ensuring that the issuer is present and valid, attempt to update the CRL again.
  You can do this by selecting the relevant certificate and using the Update CRL option.
  
  
  
  Check Network Connectivity:
  
  If the CRL is being fetched from an external source, ensure that there are no network issues preventing access to the CRL distribution point.
  
  
  
  Review Logs:
  
  Check the system logs for any additional error messages or warnings that may provide more context about the issue.
  
  
  
  Related Information:
  
  Transaction STRUST: This is the transaction used to manage SSL certificates and trust relationships in SAP.
  Certificate Authorities (CAs): Understanding the role of CAs and how they issue certificates can help in managing trust relationships.
  CRL (Certificate Revocation List): A list of certificates that have been revoked by the issuing CA before their scheduled expiration date.
  SAP Notes: Check for any relevant SAP Notes that may address specific issues related to certificate management and CRLs.
  
  By following these steps, you should be able to resolve the STRUSTCR026 error and successfully update the CRL in your SAP system.