ID Vault trust certificate missing

HCL Notes/Domino 8.5 Forum (includes Notes Traveler)

Subject: ID Vault trust certificate missing

Feedback Type: Problem

Product Area: Domino Server

Technical Area: Functionality

Platform: Windows 2003 server

Release: 8.5

Reproducible: Always

I created an ID Vault but I can't see the vault trust certificates on the primary server. When I replicate the names.nsf to other servers I can see the VT certificates on them but not the primary.

Below is the copy-and-paste from the "Create ID Vault" process.

You have successfully created the Notes ID vault 'IDVault'.

In the process of creating the vault the following tasks have been run.
Created Notes ID vault Document
Created Notes ID vault Trust Certificates
Created Notes ID vault Password Reset Authorities
Created Notes ID vault ID file (C:\Program Files\lotus\notes\data\ids\vault\idvault.id).
Created Notes ID Vault /IDVault
Vault database path: \IBM_ID_VAULT\IDVault.nsf

Add vault trust certificates to the following organizations:
/MAYBERRY was successfully added.

Add the following password reset authorities:
Andy Taylor/MAYBERRY will be able to sign self service password reset agents

Security Events:

Missing or invalid Vault Trust certificate from 'Barney Fife/MAYBERRY' to '/IDVault': Entry not found in index.

I've deleted and re-created the vault a number of times. Followed Admin help topics. Followed article in Dominowiki.

Any ideas?

Also...

sh idvault
ID Vault /IDVault (E:\Lotus\Domino\Data\IBM_ID_VAULT\IDVault.nsf)
Control Vault Name: /IDVault
Control Vault Servers: NOTES/MAYBERRY
Vault Operations Key: VO-glgt-fmbz/NOTES/IDVault
Servers: NOTES/MAYBERRY
Vault Name: /IDVault
Description: ID Vault
Administrators: Andy Taylor/MAYBERRY
Servers: NOTES/MAYBERRY
Administration Server: NOTES/MAYBERRY
Invalid or nonexistent document: No certifiers found that trust vault /IDVault
Invalid or nonexistent document: No certifiers that trust vault /IDVault trust any password resetters
Setting Vault Settings uses this vault

also...

I am using CA process.

sh server
Lotus Domino (r) Server (Release 8.5 HF211 for Windows/32) 04/20/2009 02:00:59 PM

Here is the vault certificate on one of the other servers (not the primary).

Basics
Certificate type: Notes Cross-Certificate
Issued By: /MAYBERRY
Issued To: /IDVault
Alternate names:
Combined Name: O=MAYBERRY:VT:O=IDVault
Comment:
Organizations: O=MAYBERRY:VT:O=IDVault
Primary key identifier: 1Z5HA D24K9 6D73A 4EC5S KKD8X 5342B
International key identifier: 1Z5HA D24K9 6D73A 4EC5S KKD8X 5342B
Current key strength: Compatible with 7.0 and later (2048 Bits)

Feedback number WEBB7RANKT created by ~Bill Asakrolyli on 04/20/2009

Status: Open
Comments: