Trust Madness Part 2 -- Duplicate Certs

[Kevin Kelling]

OK..fixed the problem where SIM was distributing the wrong cert.

Only a handful of our 400 servers are trusted however.

I picked 2 test servers. They each had 2 certificates for the hostname of the CMS/SIM server. SIM correctly pushed the new cert but did not remove the old one.

Once I removed the old certificte and rediscovered the system, the trust was present. I repeated this for the other node with the same results.

It appears that SIM will add certs but not take them away. Herein lies the problem. I need to find a way to remove the old cert on 400 servers -- so I can establish a trust with them -- or otherwise do it manually x400.

Please tell me there is a way to automate this. :^)

Thanks.

[Alfredo Soares]

Hi Kevin,

Since you have trusts established, did you try using "Configure->Replicate Agents Settings...", and choose a "source" server where there is only 1 certificate, and replicate the "Trusted Certificate" setting??
This procedure, replaces what you have on target server, insted of adding it.
I think the source server has to have similar Agent versions, than target server.

Hope this helps

Alfredo

[Kevin Kelling]

We already have a Replicate Agent settings task that distributes the new certificate (as well as settings) every day.

I can use the Configure and Repair agents to push the new certificate -- we've done this many times and it works too (well once you move your certs to C:\HP\SSLSHARE anyways).

Every server has the new cert, but it also has the old cert.

Removing the old cert will restore the trust, but I haven't been able to find any way to automate the removal of the old certs.

[Tusc]

Kevin, did you ever find a way to remove the old certs?