Preparing certificates for upgrades with CA‑signed certificates

Edit online

To upgrade IBM Storage Protect, you must prepare the server certificate by converting it to PKCS12 format. This prerequisite procedure ensures certificate compatibility with the upgraded server version.

Before you begin

Note:

The prerequisite procedure in this topic must be completed before you upgrade IBM Storage Protect to version 8.2.1. If you skip this step, IBM Storage Protect cannot communicate with Operations Center for specific panels such as storage rules and cloud connections.
Complete the following steps only on the IBM Storage Protect server that is the hub server where Operations Center is configured.
Because you are using a CA-signed certificate, the SERVER_ADDRESS value in <<install_dir>>/ui/Liberty/usr/servers/guiServer/serverConnection.properties must contain the full host name of the server. Do not use localhost.

If the file currently specifies localhost, update the value to the full host name of the server, save the file, and restart the Operations Center service.

Procedure

To ensure certificate compatibility before you upgrade IBM Storage Protect, complete the following steps:

Verify that certificate files exist.
Change to the server instance directory, such as /home/tsminst1.

List all the certificates in cert.kdb using the following command:
```
gsk8capicmd_64 -cert -list -db cert.kdb -stashed
```
Example output:
```
Certificates found
* default, - personal, ! trusted, # secret key
!    "SP Root CA Cert"
!    "SP Intermediate CA Cert"
!    vcloud688.storage.tucson.ibm.com:1500:0
*-   “MyServerCertificate”
```
where, the certificate marked with *- represents the server certificate.
Note: “MyServerCertificate” is an example label only. The actual certificate name depends on your environment. Identify the certificate marked with *-, and use that certificate name in the following steps to export it in PKCS12 format.

where MyServerCertificate is the host certificate.
Remove any existing PKCS12 certificate by issuing the following command:
- For Linux or AIX:
```
rm -f certp12.p12 certp12.pwd
```
- For Windows:
```
del certp12.p12 certp12.pwd
```
Export host certificate to PKCS12 format by issuing the following command:
```
gsk8capicmd_64 -cert -export -db cert.kdb -stashed -label "MyServerCertificate" 
-type pkcs12 -target certp12.p12 -target_pw "truststore_password"
```
where truststore_password is the password for PKCS12 truststore getting created.

Replace MyServerCertificate with your host certificate label received from Step 1.
Rename PKCS12 certificate label to standard name by issuing the following command:
```
gsk8capicmd_64 -cert -rename -db certp12.p12 -pw "truststore_password" 
-label "MyServerCertificate" -new_label "TSMServerSelfSignedSHAKey"
```
where truststore_password is the password for PKCS12 truststore.

Replace MyServerCertificate with your host certificate label received from Step 1.

Store the password securely for further operations by issuing the following command:

Linux:

echo "truststore_password" | base64 > certp12.pwd

AIX:

echo "truststore_password" | openssl base64 > certp12.pwd

Windows:

echo|set /p=truststore_password > input.txt
certutil -encode input.txt tmp.txt
findstr /v CERTIFICATE tmp.txt > certp12.pwd
del input.txt tmp.txt

On Linux or AIX: To set File permissions for the newly created PKCS12 truststore by issuing the following command:
```
chmod 777 certp12.p12 certp12.pwd
```
If the server is running, stop and restart the server.