PSP 7.40A and Certificates

[Rob Buxton]

Hi All,
When I install the new PSP 7.40A I find I lose my trusted certificate on the Server.

Configuring the agent doesn't seem to work too well either.
If I export the Certificate and then use the Browse function during the Agent Configure to try and load the Agent via the VCRM it fails. I have to open the Certificate manually and cut and paste it.
But if I use the RDU, the Browse / Add functionality works.
Unfortunately it doesn't matter how I populate the certificate details, after deployment no certificates are listed on the server.
These servers are at a remote site behind a firewall. If I try and import the certificate from the server that also fails with a connection error.

Anyone know what may have changed in the recent PSP?

[Rich Purvis]

Rob, unfortunately the cert configuration in VCRM is a problem - you can, however, get around it by "cut and paste" or using RDU. It should be addressed in VCRM in an upcoming release.
There appears to be an issue with preconfiguration settings not taking in certain scenarios with the System Management Homepage component. It is being looked at.

-Rich

[Rob Buxton]

Rich,
Thanks for the update.
If there is any additional info. I can supply let me know.

Any idea of the port number the certificate request uses when you try to load a certificate from the CMS?
Just that is not working from the Servers behind a firewall, I can again cut and paste but the auto-populate from the login doesn't nor can I pull it down from the agent.

[Kevin Kelling]

Is there a known remedy for this if PSP 7.4 was installed on the SIM server?

I tried downgrading the system management homepage to 7.3 but I still cannot establish a trust with ANY system -- even one where the trust mode is "trust all".

Thanks!

[Rob Buxton]

All I needed to do was manually load the certificate.
You can export the HPSIM Server Certificate to a file, open that in notepad and then manually paste that into the Agent Settings and load it.

In the reply from Rich above, it seems the problem may be in the VCRM. So it may be that changing versions of the PSP would have no effect.

Alas, I suspect you will not be able to replicate the change to other Servers because the Trust has been broken.
Those looking to deploy 7.40A to a large number of Servers may want to wait for a fix.

[Rich Purvis]

Ok, is the problem you can get the cert imported or the SMH settings are not sticking? The work around for the getting the cert imported is to use RDU or "cut and paste".
Now if the problem is that it looks like your cert or none of the SMH settings are sticking once you deploy SS7.40 you can "redeploy" the SMH component from SS7.40 with the "force" flag on the install - I believe that the preconfig has a "force" checkbox on it that may need to be ticked. Anyway, once you redeploy SMH from SS7.40 on a previous install of SMH from SS7.40 the settings should take.
There should be a web release with a fix for this and a few other issues prior to the next SS release.

-Rich

[Rob Buxton]

Rich,
I've used the RDU to paste the certificate in to the configurable agent.
That worked okay.
If I then return to configure the item the certificate is still there which indicates it is not being dropped from the configured agent.

When I deploy that agent along with the rest of the PSP to a Server no trusted certificate is present on the Server afterwards.
I've not used Force, as these are all upgrades from 7.30.
I'll try that and let you know as soon as I can.

[AaronK]

I have the same problem with pre-configuring a 'trusted by name' setting.
When I install the 7.40 PSP, it does not configure it at all and the previous trusted setting is removed and set to trust by certificate but no cert is configured. I have to manually go into the settings to setup the trust by name.

I think it is a problem in general with the preconfigured trust regardless of how you set it up.

[Rob Buxton]

Yep,
Not tested this fully yet, but there's an update to the SMH (new one is version 2.1.3.132)that was released in PSP 7.40 and that seems to retain the Trust Settings.

[Rich Purvis · Accepted solution]

The latest update to the web:

http://h18023.www1.hp.com/support/files/server/us/download/23560.html

should address the issue with the preconfiguration settings not sticking.

Thanks,

-Rich