SIM4.2 w/SP2 - Trust relationship with VCRM

[Brian Rickett]

SIM42 and the VCR are on the same box. Ther Cert is named Insight. From the Main SIM if you select Options/Version Control Repository it displays Trusted "NO". When you select the lnk "Configure" and navigate it it shows Trusted.

How do I correct this behavior? It is but it isn't trusted?

Thanks, Brian Rickett

[Ananthak23]

Once you select the VCR, click on 'Last update' link at the top of the page. Also try running identification task on SIM server and check again.

-Anantha

[Brian Rickett]

Neither of those worked. What's next?

[Paul Slater_4]

SIM may needs to 'trust by certificate'.

Look for a document like this local...
admin_cert_trusted_about_settingUpTrustRelationships.html

Same boat for me. On page 472 of 'HP System Insight Manager' is a line...
"The system that has the Version Control Repository Manager installed must be trusted". 'trust all' and 'trust by name' did not work for me.

[Paul Slater_4]

attached document admin_cert_trusted_about_settingUpTrustRelationships.html

[Brian Rickett]

Thanks, everybody. Looks like my main certificate on my Central Management server got changed (to many admins). So now I have a hundred or so managed servers that do not have a trust in place.

Anyone know how to get the Old Cert back? I thought of using the Raw Data from a managed server but I'm not having much luck there.

If this can not be done. How do I redeploy a cert to several servers (different agent levels exist)?

HP any ideas?

Thanks, Brian Rickett

[Rich Purvis]

Brian,
In HPSIM 4.2 there is feature called "Configure or Repair Agent Settings" or something to that effect. It can be used to get the certs fixed on your servers.
There is another option, I haven't looked at in a while, but you might be able to use the "Replicate Agent Settings" option as long as you are not using very old agents - I don't recall if that will do a certificate replication or not.

-Rich

[Brian Rickett]

Neither does it. Interesting the Replicate Agent settings (which is the only one that copies the Cert)comes back and says "No trust exists with the managed server. Therefore the only tool that copies certs only copies if the trust exists. The only time that is useful is if you want to update the cert(is that a conundrum? how would that be done without breaking the trust?).

Am I doing something wrong or overlooking the obvious here?

HP any ideas?

Thanks in advance. /br

[Paul Slater_4]

Just covering the basics, but did you look for *.cer?

[Rich Purvis]

Brian,
Actually, the "Configure or Repair Agent Settings" option does setup your trust - that is what it is designed to fix and does not require that you have a "trust" setup. It uses OS permissions but only works for Windows I think, are these Linux servers?

You are correct the "Replicate Agent" option does require a trust setup - that is because it is using a secure link to communicate the configuration information - forgot about that.

Are these servers setup as trust by cert or are they set as some other trust configuration - like "by name"? You might try the Config and Repair route again - SIM 4.2 SP2 should have all the fixes that were causing issues with this option in the past.

-Rich

[Brian Rickett]

Rich, I'll retry the Fix tool, however I think it is for Agents 7.10 and earlier. It asks to set the administrators password which the legacy agents use.

The issue I have is the CMS has a new "different" cert. My managed targets have the OLD cert. Therefore I'm trying import the new Cert to my targets in mass. I do not have a saved exported cert to simply re-import to the CMS (I do now)and I do not want to restore the whole machine or directory. So I'll probably just fix each target as I deploy the new 7.30 agents to our farms and use this experinece as great OJT time. The CMS still gets hardware traps and works fine. I just can't push new agents until the trusts are re-established.

I thought there may be a script somewhere that could do this. Has anybody got one?

Thanks, Brian

[Rich Purvis]

Brian,
The reason it asks for the Administrator password is to support pre-7.20 installations. It supports both. You can put a password in there or not - I think you can get by without setting that if you want - I can't recall how I used it last - but it does fix certs - I deployed a rack of blades without configuration and used that tool to get my cert trust setup. So it should work - but that is always the rub - if it always worked we wouldn't need these forums . . . .

-Rich