ECS: Dial Home - Ref_ID: EKMServerCertificateExpiry - Symptom Codes: 1361 and 1362

Summary: This is a dial-home introduced in ECS 3.3 to detect Alert.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Key Management:
     To support Data at Rest Encryption (D@RE), ECS maintains a hierarchy of encryption keys where a parent key in the hierarchy is used to protect a child key. Prior to ECS 3.3, these keys were natively managed by ECS across the geo-federated environment. From ECS 3.3, support for certain External Key Management solutions that are Key Management Interoperability Protocol (KMIP) compliant have been added. Further to support industry standard practices, ECS 3.3 now supports user initiated key rotation to limit the amount of data protected by any given key. (Further information can be found in the admin guide)

An ECS system has dialed home with the following alert.
 
SymptomCode Severity
1361 WARNING
1362 ERROR 
<?xml version="1.0" encoding="UTF-8"?>
<ConnectHome SchemaVersion="1.0.8"
    xsi:schemaLocation="/opt/connectemc/schema/ema_ConnectHome108.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <TransType>10</TransType>
    <TransTypeDesc>EventXML</TransTypeDesc>
    <TransID>0</TransID>
    <Node Status="Unknown" State="Unknown" ID="ECSQE00079">
        <Identifier>
            <DeviceState>1</DeviceState>
            <DeviceStatus>1</DeviceStatus>
            <ClarifyID>ECSQE00079</ClarifyID>
            <SiteName>UNKNOWN</SiteName>
            <Vendor>EMC</Vendor>
            <DeviceType>ElasticCloudStorageApp</DeviceType>
            <Model>ElasticCloudStorage</Model>
            <SerialNumber>ECSQE00079</SerialNumber>
            <WWN>ECSQE00079</WWN>
            <Platform>platform</Platform>
            <OS>SLES</OS>
            <OS_VER>12.3</OS_VER>
            <UcodeVer>3.3.0.0-4349.d0de882</UcodeVer>
            <EmbedLevel>2</EmbedLevel>
            <InternalMaxSize>512800</InternalMaxSize>
            <Comment>Object Alert</Comment>
        </Identifier>
        <Connection>
            <ConnectType>ESRS</ConnectType>
            <IPName>localhost</IPName>
            <ConnectNum>XXX.XXX.XXX.XXX</ConnectNum>
            <Port>22</Port>
        </Connection>
        <HeartBeat>
            <HBStatus></HBStatus>
            <HBState></HBState>
        </HeartBeat>
        <InternalData>
            <FileList/>
            <EventList>
                <Event>
                    <SymptomCode>1362</SymptomCode>
                    <Category>Configuration</Category>
                    <Severity>Error</Severity>
                    <Status>Unknown</Status>
                    <Component>Object</Component>
                    <ComponentID></ComponentID>
                    <SubComponent>EKM Server Certificate Expiry</SubComponent>
                    <SubComponentID></SubComponentID>
                    <CallHome>true</CallHome>
                    <FirstTime>2019-01-29T06:44:21.014Z</FirstTime>
                    <LastTime>2019-01-29T06:44:21.014Z</LastTime>
                    <Count>0</Count>
                    <EventData><![CDATA[]]></EventData>
                    <Description><![CDATA[The Server Certificate for EKM Server : ecs-dev-keysecure-10.XXX.XXX.XXX will expire in 3533 days 17 hours 15 minutes 53 seconds  [Ref_ID : EKMServerCertificateExpiry]]]></Description>
                </Event>
            </EventList>
        </InternalData>
        <ExternalFiles/>
    </Node>
</ConnectHome>

 

Cause

The Server Certificate for EKM server expires in 7 days. Renew the Certificate.

Resolution

  1. Connect to one of the nodes in the cluster using a putty session.
  2. Verify Current Sensor Status
  3. Look for the value of the <CurrentState> tag in the output above. The condition is not active when 'OK' is the value reported. The values 'Warning' or 'Error' indicate that the issue is present and that troubleshooting steps are required.
  4. Check the alert for the 'Description' section to gather the affected EKM server and the certificate expiration date.
  5. Take the server information and expiration date gathered in the previous step and provide that to the customer so that they can renew the certificate. This needs to be done on the customer s EKM server
  6. Once the customer has the new certificate, they need to update the ECS with it. The steps can be found in the administration guide in the Key Management section under ECS Settings.
  7. If the issue still persists, open a Service Request to Dell Technologies ECS support to help investigate the issue.
svc_rest_cmd /vdc/sensor/status/EKMServerCertificateExpiry
 
Example: 
admin@provo-cream:~> svc_rest_cmd /vdc/sensor/status/EKMServerCertificateExpiry
svc_rest_cmd 1.0.10

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SensorStatusList>
  <SensorId>EKMServerCertificateExpiry</SensorId>
  <ListSensorStatus>
    <SensorStatusRestRep>
      <ContextId>EKMServerCertificateExpiry</ContextId>
      <CurrentState>OK</CurrentState>
      <NodeId>1f4368c3-37cd-467f-9efc-289264806ea0</NodeId>
      <PreviousState>OK</PreviousState>
      <Time>1551118064264</Time>
    </SensorStatusRestRep>
  </ListSensorStatus>

    Example:  
<Description><![CDATA[The Server Certificate for EKM Server : ecs-dev-keysecure-10.XXX.XXX.XXX will expire in 3533 days 17 hours 15 minutes 53 seconds  [Ref_ID : EKMServerCertificateExpiry]]]></Description>

 

Affected Products

ECS Appliance

Products

ECS Appliance, ECS Appliance Hardware Gen1 U-Series, ECS Appliance Software with Encryption, ECS Appliance Software without Encryption, Elastic Cloud Storage
Article Properties
Article Number: 000037612
Article Type: Solution
Last Modified: 17 Dec 2025
Version:  5
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.