@RMills1 ,

I'm sorry to hear that you are having issues post CA renewal. When you looked in the cacert file (in the security server service), did you remove the old CA thumbprint?  Did you also renew the other cacert locations on the back-end? 

Do you have a front-end server? If so, have you renewed the certs on the the front-end server as well?

-Brian

L4 | Dell Data Security #IWork4Dell

Hey Brian,

I didn't remove the old CA thumbprint. I wasn't sure if I needed to leave it for old certificates or not, as not all our users have re-enrolled their smart cards.

I wasn't aware there are other cacert locations. Could you send me the locations on the virtual appliance?

I don't have a front-end server, but I've been planning to add one since I've gone from ~110 clients to ~1300 clients. I'll keep in mind I'm going to need to add the CAs into cacerts.

Thanks,

RMills1

Hey Brian,

I found the following locations for cacerts:

/opt/dell/server/core-server-proxy/conf/cacerts
/opt/dell/server/forensic-server/conf/cacerts
/opt/dell/server/local-server/conf/cacerts
/opt/dell/server/reporter/conf/cacerts
/opt/dell/server/security-server/conf/cacerts

Can you confirm I need to add my CA certs to all of these?

Thanks,

Rmills1

So I went ahead and removed the old CA certs from the cacerts file.  One of my users on client v10.3 worked!  However, another client on 10.2 still didn't work, so I'll update them to 10.3 and see what happens.

Also, it appears the software automatically updates the other cacerts file when you update the /opt/dell/server/security-server/conf/cacerts file.

Thanks!

@RMills1, My apologies about the delay as I was on PTO. You were correct on the location for the other cacerts. I'm glad to hear 10.3.0 client seems to be working for you. I would suggest we get a case opened up with our support folks if the issue persists by collecting logs for Client: https://www.dell.com/support/article/us/en/19/sln294330/how-to-collect-logs-for-dell-data-security-dell-data-protection-using-diagnosticinfo?lang=en Server: https://www.dell.com/support/article/us/en/04/sln301253/how-to-collect-logs-for-dell-security-management-server-virtual-dell-data-protection-virtual-edition?lang=en Contact info for our phone support https://www.dell.com/support/article/us/en/04/sln297692/dell-data-security-international-support-phone-numbers?lang=en

Hey Brian,

While it seemed to work for some users, most still aren't working.  I reproduced it on a test account and captured the logs.  I should have time this afternoon, so I'll call support then.  Thanks for the help!

RMills

@RMills1 ,

 

Sorry to hear that you are having inconsistent results. Inconsistency is always when it comes to troubleshooting an issue. 

When the agent gets the logs he should be troubleshooting the communication from CMGAgent.log > Security Server Output.log. (which is located in the opt/var folder for the Server logs).

If you end up running into any snags, shoot me a PM with the SR (service request number) and I will see what I can do to help you get your issues resolved quickly.

Have a good one.

-Brian

L4 | Dell Data Security #IWork4Dell