IT46444: UNABLE TO IMPORT THE VMWARE VCENTER SERVER CERTIFICATE TO KEY.JKS ON LINUX BECAUSE OF AN INCORRECT PASSWORD FOR THE KEYSTORE

APAR status

• Closed as documentation error.

Error description

• After upgrading the IBM Storage Protection for Virtual
  Environments: Data Protection for VMware to version 8.1.23.0 the
  VMware vCenter server certificate must be imported to the
  key.jks of the Data Protection for VMware GUI host as per the
  documentation chapter :
  https://www.ibm.com/docs/en/spfve/8.1.23?topic=cssdpv-configuri
  ng-data-protection-vmware-vsphere-gui-communication-vcenter-ser
  ver
  
  The import of the certificate to the keystore using the
  documented default password "tsm4ve" fails because of an
  incorrect password for the keystore with the following error
  message:
  "Keystore was tampered with, or password was incorrect"
  
  | MDVREGR 8.1.23.0-5725TVEVM |
  
  IBM Storage Protect Versions Affected:
  IBM Storage Protect for Virtual Environment: Data Protection for
  VMware version 8.1.23.0 and later on all supported Linux
  platforms.
  
  Additional Keywords: SP, TSM , SP4VE, TS016541651 , key.jks,
  certificate, import, keystore, password, incorrect, tampered
  

Local fix

• 1- If the installation logs still are available, you can run the
   following command to get the keystore password:
      grep -ir "storepass"
  /opt/tivoli/tsm/tdpvmware/_uninst/TDPVMware/Logs/
  
  
    The above command should show the following output:
       /opt/tivoli/tsm/tdpvmware/_uninst/TDPVMware/Logs/IBM_Stora
  ge_Protect_for_Virtual_Environments:_Data_Protection_for_VMware
  _Install_06_21_2024_13_57_35.log:ExecuteCommand:
  
     /opt/tivoli/tsm/tdpvmware/common/jre/jre/bin/keytool -genkey
  -keyalg RSA -sigalg SHA256withRSA -storetype jks -alias vekey
  -keystore
  
     /opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/vePro
  file/resources/security/key.jks-storepass "<Password_String>" -k
  -validity 3650 -keysize 2048 -dname "cn=localhost.localdomain,
  ou=Tivoli_Storage_Manager_for_VMware, o=IBM"
  
  
     You can then use the <Password_String> to import the
  certificate.
  
  
  2- If the installation logs are not available then use the
  following documentation to recreate the key.jks keystore with
  the appropriate password:
  https://www.ibm.com/docs/en/spfve/8.1.23?topic=authority-obtain
  ing-access-keystore
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Protect Data Protection for Virtual Environments *
  * version 8.1.23.0                                             *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * see Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * The document is currently projected to be updated in IBM     *
  * Storage Protect Data Protection for Virtual Environments     *
  * 8.1.23.1. Note that this is subject to change at the         *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• The Data Protection for VMware Installation Guide has been
  updated to handle keystore password correctly on Linux platform.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels