Troubleshooting the certificate key database

Edit online

Backup copies of certificate key database that is the cert.kdb file ensures that Transport Layer Security (TLS) starts when you restore the IBM Storage Protect server. If you do not have a backup copy of certificate key database, create a new certificate key database.

Procedure

To create a new certificate key database, complete the following steps:

  1. Delete all cert* files from the server instance directory.
  2. Shut down the server.
  3. Start the server. The server automatically creates a new cert.kdb file.
    Important: The server generates a self-signed certificate that can be extracted for clients and IBM® business partners servers to use. If the cert.kdb file exists and the server did not create it, an out-of-sync condition occurs, preventing the server from setting up SSL communications.
  4. Redistribute the new .arm file to all backup-archive clients that are using TLS. If you are using TLS 1.2 or TLS1.3, use the cert256.arm file. Reinstall any third-party certificates on the backup-archive client. If you are using an LDAP directory server to authenticate passwords, add the root certificate that was used to sign the LDAP server’s certificate. If the root certificate is already a default trusted certificate, you do not have to add it again.

What to do next

Back up all the following cert* files from the server instance directory, which helps you to avoid losing connectivity in case certificate and password files are lost or corrupted:
cert.kdb
This file is the actual certificate key database.
cert.sth
This is the password stash file for the certificate key database. The stash file contains an obfuscated copy of the password that is required to access the contents of the certificate key database. This is the only copy of the password and if this password is lost, the existing certificate key database can no longer be used.
cert256.arm
This is an exported copy of the server's self-signed TLS certificate. Distribute this file to new clients so that they can connect to the server by using TLS.