FLASH ALERT: IBM Tape Drive CA certificates expiring in Guardium Key Lifecycle Manager - Action required before 30 June 2026

1. Download the renewed certificates.
   • Download ibmTapeDrive2048.zip.

   • Extract the archive to access:

      - ibmrootca.pem (renewed root CA certificate)

      - realsubcacert.pem (renewed subordinate CA certificate)

2. Import the renewed certificates.
   • Login to Guardium Key Lifecycle Manager UI and complete the following steps for both the downloaded certificates.
   • Go to Advanced Configuration > Client Device Certificates > Import.

   • Configure the import.

     - Certificate name: Enter the certificate name for ibmrootca.pem or realsubcacert.pem. For example, ibmrootca2048.

     - Upload certificate downloaded in .pem format in step 1.

     - Device Group: Select the device group that is currently using certificates signed by the expiring Truststore CA certificates.
     Do not leave this field blank.

     Note: - If there are multiple device groups of type LTO or 3592, you only need to import the certificates once, not for each device group.

     - If you do not have, or do not use, device group of type LTO or 3592, you can skip this step.

     - Check: Allow the server to trust this certificate with the associated client device.

   • Click Import.

      

3. Adjust the notification settings (optional but recommended)

   Complete the following steps to reduce frequent notifications and emails about expiring certificates:

   1. Login to Guardium Key Lifecycle Manager UI.
   2. Go to Advanced Configuration > Notification configuration > Notification.

   3. Set Certificate expiry service frequency to 168 (hours).

      Note: This setting will affect notification frequency for all the expiring or expired certificates in Guardium Key Lifecycle Manager and not just tape drive certificates.

4. Remove the old certificates (After 1 July 2026).

   Note: Complete this step in the first week of July 2026 (after the old certificates expire).

   1. Login to Guardium Key Lifecycle Manager UI.
   2. Go to Advanced Configuration > Client Device Certificates > Show preinstalled certificates.

   3. Select the following expired certificates.

      - ibmrootca

      - realsubcacert

   4. Click Delete.

   5. Reset the notification settings in step 3 back to original value (recommended 24hours).

       

Back to top

1. Adjust the notification settings (optional but recommended).

   Complete the following steps to reduce frequent notifications and emails about expiring certificates: 

   1. Login to Guardium Key Lifecycle Manager UI.
   2. Go to Configuration > Notification settings > Notification.

   3. Set Certificate expiry service frequency to 168 (hours).

      Note: This setting will affect notification frequency for all the expiring or expired certificates in Guardium Key Lifecycle Manager and not just tape drive certificates.

2. Remove the old certificates (After 1 July 2026)

   Note: Complete this step in the first week of July 2026 (after the old certificates expire).

   1. Login to Guardium Key Lifecycle Manager UI.
   2. Go to Configuration > Encryption endpoint certificates > Show preinstalled certificates.
   3. On the row of expiring certificate, click 3 dots for Options > Delete.

   4. Delete the following expired certificates.

      - ibmrootca

      - realsubcacert

   5. Reset the notification settings in step 1 back to original value (recommended 24hours).

       

Back to top

1. How can I check if Tape drives or 3592 devices are communicating with Guardium Key Lifecycle Manager over SSL/TLS?

Answer: The following are the default ports used for SSL/TLS communication with Guardium Key Lifecycle Manager:

• Port 5696: Key Management Interoperability Protocol (KMIP) port
• Port 1441: IPP over SSL/TLS port

To determine whether SSL/TLS is being used, verify if the device is communicating with Guardium Key Lifecycle Manager over port 5696 or 1441. If either of these default ports is in use, then SSL/TLS communication is enabled.

2. What is the impact of not deleting the old certificates?

Answer. There is no functional impact. However, you may receive notifications. It is recommended to delete the old certificates after 1 July 2026.

3. What should I do if I am unsure whether my environment is impacted?
Answer: Export the device certificate and verify the details. If the issuer is 'IBM Tape Drive' and the algorithm is 'SHA-1', then update the certificate.
For steps to export LTO/3592 device certificates, refer to the LTO/3592 device documentation. 

4. In a Master/Clone setup, do I need to update certificates on both systems?
Answer: No. You only need to import the certificate on the Master system. Then, trigger a full replication.

5. In a Multi-Master setup, where should the certificate be updated?
Answer: Update the certificate on the primary or any standby system. Ensure that HADR is up and the servers are connected.

6. Does this issue affect all LTO drives?
Answer: Not necessarily. Export the device certificate and check the details. If the issuer is 'IBM Tape Drive' and the algorithm is 'SHA-1', then update the certificate.
For steps to export LTO/3592 device certificates, refer to the LTO/3592 device documentation.

7. When will the new certificates be used, and how can I verify this?
Answer: The new certificates will be used automatically after import when the old certificates expire.
To verify the usage:

• Enable SSL tracking in Liberty by setting: Djavax.net.debug=ssl:handshake in jvm.options
• Restart Liberty
• Run the KPD test
• Check the console.log of Liberty

8. How can I confirm whether certificates are in use, or should I replace them anyway?
Answer: You can check by verifying the port (5696 or 1441 for SSL/TLS). If unsure, it is safe to replace the certificates, as they are part of the base product.

9. What happens if I delete old certificates before they expire?
Answer: If deleted before expiry, the certificates will reappear after Liberty restart. It is recommended to delete them only after they expire.

10. How can we verify whether the certificate is signed by IBM tape?
Answer: Tape drives that communicate with Guardium Key Lifecycle Manager over SSL/TLS using certificates signed by the SHA1-based expiring CA certificates (ibmrootca and realsubcacert) will stop communicating once those certificates expire. To verify, the device team should check whether the certificate in use is signed by ibmrootca or realsubcacert, since the certificate is owned and presented by the device during communication with Guardium Key Lifecycle Manager. They can export the device certificate and examine the CA authority. Typically, the issuer name and SUID will match the root certificate, confirming the signature.

11. What if the communication between the storage and Guardium Key Lifecycle Manager break even after following the suggested procedure?
Answer: As an immediate recovery step, set the TransportListener.ssl.clientauthentication= 0. Use REST interface or swagger UI to update this property in SKLMConfig.properties.

• Using REST interface:

1. Open a REST client. For more information, see Using Swagger UI.
2. Run the Update Config Property REST Service to update the TransportListener.ssl.clientauthentication. 

For example, you can send the following HTTP request:

PUT https://localhost:<port>/GKLM/rest/v1/configProperties
{ 
"TransportListener.ssl.clientauthentication": "0"
} 

This will disable client authentication. The communication between storage and Guardium Key Lifecycle Manager will be restored. 

Please contact IBM support for further steps after device communication is restored.

Back to top