Trust Madness

[Kevin Kelling]

SIM Server was moved to new hardware with a new name.

To get to the point, the Repair agents tool is not distributing the correct certificate.

Had problems from the start with trusts on the new SIM install. Last night I spent several hours playing around. This included:

1) Creating new server certificate for SIM
2) Reboot SIM server
3) Use Repair agents tool to distribute certificate.

The repair agents tool log indicates sucess on most servers, but none are trusted.

The certificate that is being distributed does NOT match the date! The certificate being distributed has an active date of June 26 which is when the new SIM server was first installed. I would expected it to have a date of 7-12 which is when the new server certificate was generated.

If I go to any managed node and use the "get certificate from server" option I get the right certificate with a date of 7-12.

Trying to find a way to fix my trusts that does not involve going to 400 servers and manually doing this task.

Why is the Repair Agents tool distributuing the wrong cert? Is there a way to fix?

This is a clean install of SIM 4.2 SP2 on Windows. All we did is import the hosts file from the old server. New database and we did not do anything with certificates until I tried making a new one last night.

Thanks!

[Rob Buxton]

You could try the following:
On a selected Server, use the Get Certificate Option. test that the trust works as expected.

Then from HPSIM, go to Configure -> Replicate Agent Settings.
Select the Servers to deploy to.
Select the Server where you set the Trust above as the template.
Select the Trust Details as the item to replicate.

[Kevin Kelling]

After much trial and error I figured it out. I searched for all *.CER files on the system and compared dates.

For some odd reason, SIM itself was using the SSLSHARE directory on the D drive, but when pushing certifictes, it would push what evert certificates were on C:\HP\SSLSHARE.

So I moved the certs from D to C and then SIM would push out the correct cert (The one I made by creating a new server cert in SIM).

How we managed to get 2 cert directories on a clean SIM $.2 SP2 install on new hardware and have this "directory disparity" is completely beyond my comprehension.