Version Control Repository - Trust Relationship Error

[Chipjnr]

Hi,

I'm planning on upgrading the PSP to version 7.70 A on the Insight Clients.
When logged onto the Insight server I go to Options, VCR & I select the Insight server.
The trusted status is Yes & "Trust by Certficate".
I get the following error "Error retrieving repository. Be sure a trust relationship is established with the repository device"

Any ideas as the Insight server trusts itself?

Neil

[Daniel Leblanc]

I usally do is go at the side of the client and:
1 All you re server SNMP setting are set for TRAPS>Communite name(correc name),TRAPS>Communite name>traps destination> 1-server Insight & 2-127.0.0.1
#2 All you re server snmp setting are set for SECURITE> Accepted community name>Communite name(correc name),All you re server snmp setting are set for SECURITE> Accepted community name>Communite name> Accepted packet from these host>1-server Insight & 2-127.0.0.1.

3# in youre Home page manegement>Setting>Securite
A_IP Binding-Nothing
B_IP Restricted Login-Nothing
C_Local Server Certificate-Nothing
D_Local/Anonymous Access-Nothing
E_Trust Mode>Secure Trust Modes:Trust by Certificate
F_Trusted Management Servers>Importe you Insight server certificate
G_User Groups-Nothing.

And then when i click in hp sim to go to the server (HomePageManagement) i never have any trouble!

[Larry Shaw]

We have a similar if not identical problem.

The VCRM is on the Central Management Server.
The appropriate certificates are in place.

The SMH on the CMS and the local VCA indicate an appropriate trust relationship.

Any client accessing the VCRM with the certificate verify a trust relationsuip.

However, whenever we try to use the SIM Management page to do a software distribution, at the point where it is attempting to connect to the VCRM to obtain the catalog, the server has a yellow triange in the "trust" column but shows "trusted" on the right side. It fails in the connection to the VCRM with the same "Error retrieving repository. Be sure a trust relationship is established with the repository device.

We have uninstalled and reinstalled the VCRM and also uninstalled and reinstalled SIM for the 5.1 upgrade and still have the same results. This had started to occur for the last month or so under 5.0 and we had hoped that the 5.1 upgrade/re-install would resolve the issue but it did not.

[TexasSAJack]

I get the same message but I am not using Trust Certificates at this time. I am using Trust by Name. Is that an issue? Do I need to use certificates.

The VCRM is on the CIM server.

[Larry Shaw]

I have finally resolved my issue mentioned above.

At HP's suggestion, we changed the CMS to trust by name rather than certificate. That did not work. We re-installed SIM and then deleted and reinstalled the VCRM while keeping the repository. We still had the problem. Finally, I decided to clear the entire repository and let it repopulate from HP, without reinstalling SIM or VCRM. That appears to have resolved the issue for us.

[TexasSAJack]

We are restricted from connecting our server to the Internet, therefore we have to pull the repository from our desktop and then populate the repository from there.

Would rebooting the SIM server after setting the Trust Name fix the issue? The folks here only want to reboot as a last resort.

[Larry Shaw]

You should be able to resolve a pure trust issue by restarting the SMH and possibly the VCRM service on the CMS. The key thing is that the SMH on the CMS must be set up to trust itself, either by name or by certificate.

[TexasSAJack]

Thanks Larry, I have tried all of those steps multiple times and still ther the same message:

"Error retrieving repository. Be sure a trust relationship is established with the repository device."

The only thing I haven't tried is restarting the box. I might try to uninstall the VCRM and re-install it with the trust name already set.

Will check back later with results. Last resort is to call HP Supprot. Thanks!

[FlightRisk]

I have found that this is a snmp issue. We have to reconfigure hpasm on the server. Sometimes you will need to restart hpsmhd and hpvca.

We are running Linux, this is the steps I take.
rchpasm reconfigure
or /etc/init.d/hpasm reconfigure

rchpvca stop
or /etc/init.d/hpvca stop

rchpsmhd restart
or /etc/init.d/hpsmhd restart

rchpvca start
or /etc/init.d/hpvca start

Hope that helps.

Mark

[TexasSAJack]

Thanks everyone. Just got off the phone with HP and even though they say it will work, you cannot use Name Trust you have to use Certificate. When the tech at HP changed his to Trust by Name it breaks his VCRM trust and he gets the same error that I did.

Thanks Again!

[Ai]

I have often seen this error. Deleting the client from SIM and the "re-discovering" it has done the trick numerous times.

[TexasSAJack]

Thanks. I will try that before going to certificates.

Jack

[are kjersem]

Hi!

I've had the same problem, it was a problem with DNS resolving ip address to DNS name. If you do a reverse lookup of the ip address for the SIM server, and the dns name returned are different from the dns address contained in the certificate for the SIM server, the trust will fail.
The DNS address of the certificate can be found in Options > Security > Certificates > Server Certificate > Common Name (CN). This will be the DNS address that the ip address must resolve to. Do a ping -a ipaddress the dns servername and dns zone returned should match the CN in the certificate!

[Larry Shaw]

We finally resolved this issue but I have no idea why the process worked. In desparation, we cleared the contents of the repository and recreated it and the "trust relationship" problem went away.

[Mike Angley]

I have had to do this multiple times. I have been running "trust by name" for several years now without any issues.

The copy the repository to another server, delete the repository on the CMS, then copy it back down works....but only for a little while. Last time it worked for a week and a half. About to do this for the 5th time in the last 3 months.

Getting a bit old, haveing to spend half a day to do this, and then not have it work for long.