Chapter 3 System Preparation
HPSS Installation Guide September 2002 191
Release 4.5, Revision 2
3.8.8 Updating Expired SSL Certificates
Whenthe Data Server certificate expires, the Data Server itself will be able to start up and execute,
but anyhpssadm client attempting to connect to it will fail with the error "untrusted server cert
chain". Anew certificate must be generated for the Data Server and disseminated to all the client
machines. To do this, follow these steps:
1. Check the keystore and thecacerts file to be sure the certificate has expired. On the host
where the Data Server executes, check the Data Server keystore:
% cd /var/hpss/ssm
% $JAVA_HOME/bin/keytool -keystore keystore.ds -list -v
On each host where anhpssadm client executes, check the cacerts file:
% cd $JAVA_HOME/lib/security
% $JAVA_HOME/bin/keytool -keystore cacerts -list -v
Look in the output for the Data Server certificate and its expiration date. If the certificate
has not expired, there is no need to continue with this procedure; pursue the problem
diagnosis steps in Chapter 13: HPSS Problem Diagnosis and Resolution (page 485) in the
HPSS Management Guide.
2. On the host where the Data Server executes, delete thekeystore.ds file with the expired
certificate.
% cd /var/hpss/ssm
% rm keystore.ds
3. On each host where anhpssadm client executes, delete the expired certificate from the
cacerts file:
% cd $JAVA_HOME/lib/security
% $JAVA_HOME/bin/keytool -keystore cacerts -delete -alias \
hpss_ssmds
4. Recreate thekeystore.ds file, export the certificate, and import it into the cacerts file on
everyhpssadm client machine, using the original installation procedures in this chapter.
3.8.9 Background Information3.8.9.1 Basic Security TechnologiesRelevant to the SSM Command Line Utility
This section is intended to provide an overview of the basic principles of the Java security policy,
public key encryption, SSL, and X.509 certificates as they are used in the SSM Data Server and
CommandLine Utility. For a more thorough discussion of these technologies, see the references in
Section 3.8.9.2:References on page 194.
Java allows code to run under a Security Manager. This is basically a library that gets called any
timea security-related operation, such as an access of the local file system, is requested. The library