topic Re: Trust Madness Part 2 -- Duplicate Certs in Server Management - Systems Insight Manager

Trust Madness Part 2 -- Duplicate Certs

Kevin Kelling — Fri, 15 Jul 2005 05:44:44 GMT

OK..fixed the problem where SIM was distributing the wrong cert.

Only a handful of our 400 servers are trusted however.

I picked 2 test servers. They each had 2 certificates for the hostname of the CMS/SIM server. SIM correctly pushed the new cert but did not remove the old one.

Once I removed the old certificte and rediscovered the system, the trust was present. I repeated this for the other node with the same results.

It appears that SIM will add certs but not take them away. Herein lies the problem. I need to find a way to remove the old cert on 400 servers -- so I can establish a trust with them -- or otherwise do it manually x400.

Please tell me there is a way to automate this. :^)

Thanks.

Re: Trust Madness Part 2 -- Duplicate Certs

Alfredo Soares — Fri, 15 Jul 2005 06:45:18 GMT

Hi Kevin,

Since you have trusts established, did you try using "Configure->Replicate Agents Settings...", and choose a "source" server where there is only 1 certificate, and replicate the "Trusted Certificate" setting??
This procedure, replaces what you have on target server, insted of adding it.
I think the source server has to have similar Agent versions, than target server.

Hope this helps

Alfredo

Re: Trust Madness Part 2 -- Duplicate Certs

Kevin Kelling — Fri, 15 Jul 2005 06:56:03 GMT

We already have a Replicate Agent settings task that distributes the new certificate (as well as settings) every day.

I can use the Configure and Repair agents to push the new certificate -- we've done this many times and it works too (well once you move your certs to C:\HP\SSLSHARE anyways).

Every server has the new cert, but it also has the old cert.

Removing the old cert will restore the trust, but I haven't been able to find any way to automate the removal of the old certs.

Re: Trust Madness Part 2 -- Duplicate Certs

Tusc — Thu, 04 Dec 2008 18:14:42 GMT

Kevin, did you ever find a way to remove the old certs?