PowerFlex 3.X: MDM Certificate has Expired

Summary: Scli commands fail with "SSL Error: certificate has expired."

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Any scli commands fail with this error.

SSL Error: certificate has expired.

This prevents operations such as generate_mdm_csr, replace_mdm_security_files, set_management_client_communication (to enable or disable secure communication), and so on.

Other management tools such as GW and UI may fail to manage the cluster too.

Impact:

Inability to manage ScaleIO, VxFlex OS, or PowerFlex environment.

Cause

The management clients (Command-Line Interface-CLI, Gateway-GW, or User Interface-UI) establish secure communication to the Primary Meta Data Manager (MDM), before which the certificate must be validated. When the certificate has expired, the clients cannot connect to the primary MDM.

Resolution

Note: To avoid this issue, closely monitor the certificates' expiration dates and renew certificates before expiration.

 

To address the issue after it has occurred:

  1. Identify the Primary MDM and Secondary MDMs:
    1. On all MDM nodes, run the following command:
netstat -anp | grep :6611.*LISTEN

If it returns an entry, then it is the Primary MDM; otherwise it is the Secondary.
  1. Identify all MDMs (Primary and Secondary) that have expired certificates:
    1. On All MDM Managers, run the following command:
 
  
scli --query_cluster --tech
If it returns "SSL Error: Certificate has expired", then follow the steps below; otherwise this command should show the certificate information about the nodes, including expiration date.
  1. Run the following command on the MDMs with the expired certificates. Run the command on the Secondary MDMs first, and then the Primary MDM last.
  • Remove:
/opt/emc/scaleio/mdm/cfg/mdm_management_certificate.pem;
  • ​​​​​​Restart MDM service
pkill mdm

This generates a new self-signed certificate, which can then be added to the truststores of the management clients, as they would prompt.

Impacted Versions:

PowerFlex versions 2.x and 3.x

Affected Products

VxFlex Product Family

Products

VxFlex Product Family
Article Properties
Article Number: 000035577
Article Type: Solution
Last Modified: 14 Jan 2026
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.