Hi Alfredo,

Please refer the Product Security Guide, under Generating a Certificate for Avamar.

This has the steps to generate and insta

http://powerlink.emc.com/km/live1//en_US/Offering_Technical/Technical_Documentation/300-008-816.pdf

http://powerlink.emc.com/km/live1//en_US/Offering_Technical/Technical_Documentation/300-007-039.pdf

Thanks

Hi,

I updated the /root/.keystore file by following the procedure in the document but when restarting the ems server I still get the old certificate, not the new one that I configured.

Am I still missing something?

The keystore was updated like this with the new certificate:

root, Jul 8, 2010, trustedCertEntry,
Certificate fingerprint (MD5): 13:CF:70:DF:88:1D:01:74:ED:45:FA:34:C9:97:51:E8
tomcat, Jul 8, 2010, PrivateKeyEntry,
Certificate fingerprint (MD5): D7:34:18:E5:08:85:AF:75:48:43:83:8A:B7:91:23:26
mcssl, Jun 24, 2010, trustedCertEntry,
Certificate fingerprint (MD5): 61:42:FC:CD:FC:CB:6E:59:CC:48:5E:D9:71:05:F0:B4

Any ideas? Thanks for your help

This is the procedure that I am following:

dpnctl  stop ems

keytool  -delete -alias tomcat

keytool -genkey -alias tomcat  -keyalg RSA -dname "CN=server.domain.local, OU=IT Backup, O=company, L=City, S=City, C=US"

keytool -certreq -alias  tomcat

keytool -import -trustcacerts -alias  root -file root.crt

keytool -import -alias tomcat -file  cert.crt

dpnctl start  ems

Anyway I don't know why the EMS server completely ignores this certificate and continues using his own autogenerated EMC certificate.

How can I debug this? Where is the keystore configured in tomcat?? Looks like it's reading the keystore from a different file, not the one that I created. Mine is in /root/.keystore

I'd appreciate your help. Thanks

I found the answer. I know why it didn't work because actually this is not documented anywhere in the Avamar Security Guide.

There is a specific webserver for the DTLT (Desktop and Laptop) functionality. For this server there is no documentation in the Avamar Guide. This Guide only documents the procedure for the ems server. Actually there are three different webservers inside Avamar!!! Unbelievable!!

Anyway what I did was to create the key using keytool as I already posted before.

Then I had to edit the file: /usr/local/apache-tomcat-5.5.27/conf/server.xml

And added the following line in the Connector section for the 8444 port:

keystoreFile="/home/.keystore" keystorePass="******"

The I restarted the dtlt service:
dpnctl stop dtlt

dpnctl start dtlt

And then the webserver showed the certificate that I created.

I hope this will be of help for others.

Cheers