2021년 3월 23일부터 AWS S3 인증서 변경을 처리하는 방법
Summary: AWS는 Amazon Trust Services CA에서 발급한 인증서로 S3용 서버 인증서를 변경하고 있습니다. 이는 AWS 커뮤니케이션에 따라 2021년 3월 23일부터 시작됩니다. 이 변경 사항은 ATOS(Active Tier on Object Storage)와 함께 AWS 클라우드 플랫폼에 배포된 클라우드 계층과 DDVE(Data Domain Virtual Edition)로 구성된 Data Domain 시스템에 영향을 미칩니다. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
이 인증서 변경으로 인해 클라우드 계층으로 구성된 Data Domain 시스템의 클라우드 장치가 연결 해제 상태가 됩니다.
또는
ATOS와 함께 AWS에 배포된 DDVE의 경우 파일 시스템이 비활성화되며 다음과 같은 알림 메시지가 표시됩니다.
# alert show current
Id Post Time Severity Class Object Message
----- ------------------------ -------- ----- ------------------------ -------------------------------------------------------------------------
m0-76 Mon Apr 19 15:34:03 2021 CRITICAL Cloud CloudUnit=aws-unit EVT-CLOUD-00001: Unable to access provider for cloud unit aws-unit.
----- ------------------------ -------- ----- ------------------------ -------------------------------------------------------------------------
There is 1 active alert.
# cloud unit list
Name Profile Status
-------------- --------- ------------
aws-unit aws Disconnected
-------------- --------- ------------
Id Post Time Severity Class Object Message
----- ------------------------ -------- ----- ------------------------ -------------------------------------------------------------------------
m0-76 Mon Apr 19 15:34:03 2021 CRITICAL Cloud CloudUnit=aws-unit EVT-CLOUD-00001: Unable to access provider for cloud unit aws-unit.
----- ------------------------ -------- ----- ------------------------ -------------------------------------------------------------------------
There is 1 active alert.
# cloud unit list
Name Profile Status
-------------- --------- ------------
aws-unit aws Disconnected
-------------- --------- ------------
또는
ATOS와 함께 AWS에 배포된 DDVE의 경우 파일 시스템이 비활성화되며 다음과 같은 알림 메시지가 표시됩니다.
Alert History
-------------
Id Post Time Clear Time Severity Class Object Message
----- ------------------------ ------------------------ -------- ----------------- ------ --------------------------------------------------------------------------------------
m0-26 Tue Apr 6 13:58:41 2021 Tue Apr 6 13:59:03 2021 ERROR Filesystem EVT-FILESYS-00008: Filesystem has encountered an error and is restarting.
m0-27 Tue Apr 6 14:19:59 2021 Tue Apr 6 14:20:03 2021 ALERT Filesystem EVT-FILESYS-00002: Problem is preventing filesystem from
-------------
Id Post Time Clear Time Severity Class Object Message
----- ------------------------ ------------------------ -------- ----------------- ------ --------------------------------------------------------------------------------------
m0-26 Tue Apr 6 13:58:41 2021 Tue Apr 6 13:59:03 2021 ERROR Filesystem EVT-FILESYS-00008: Filesystem has encountered an error and is restarting.
m0-27 Tue Apr 6 14:19:59 2021 Tue Apr 6 14:20:03 2021 ALERT Filesystem EVT-FILESYS-00002: Problem is preventing filesystem from
Cause
AWS는 Amazon Trust Services CA에서 발급한 인증서로 S3용 서버 인증서를 변경하고 있습니다. 이는 2021년 3월 23일부터 시작됩니다.
S3 버킷에 액세스하려면 현재의 Baltimore CyberTrust Root 인증서 대신 새로운 Starfield Class 2 Certification Authority rootCA 인증서가 필요합니다.
Resolution
다음 단계는 ATOS와 함께 AWS 클라우드 플랫폼에 배포된 DDVE 및 클라우드 계층으로 구성된 Data Domain 시스템에 적용됩니다.
- 다음 예와 같이 시스템이 현재 클라우드 애플리케이션에 "Baltimore CyberTrust Root"를 사용하고 있는지 확인합니다.
sysadmin@dd01# adminaccess certificate show
Subject Type Application Valid From Valid Until Fingerprint
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
dd01.example.com imported-host ddboost Sat Jun 20 15:09:16 2020 Thu Jun 19 15:09:16 2025 12:DB:62:AA:E8:59:5B:E9:63:29:A0:DC:6B:63:B2:BB:E5:77:07:C6
avamar.example.com imported-ca login-auth Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
avamar.example.com imported-ca ddboost Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
Certificate signing request (CSR) exists at /ddvar/certificates/CertificateSigningRequest.csr
Subject Type Application Valid From Valid Until Fingerprint
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
dd01.example.com imported-host ddboost Sat Jun 20 15:09:16 2020 Thu Jun 19 15:09:16 2025 12:DB:62:AA:E8:59:5B:E9:63:29:A0:DC:6B:63:B2:BB:E5:77:07:C6
avamar.example.com imported-ca login-auth Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
avamar.example.com imported-ca ddboost Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
Certificate signing request (CSR) exists at /ddvar/certificates/CertificateSigningRequest.csr
- 다음 페이지에서 Starfield Class 2 Certification Authority rootCA 인증서를 다운로드합니다.
https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certif: icate-authority/
"here"을 마우스 오른쪽 버튼으로 클릭하고 다른 이름으로 저장합니다.
"here"을 마우스 오른쪽 버튼으로 클릭하고 다른 이름으로 저장합니다.
인증서 다운로드를 위한 대체 링크: https://certs.secureserver.net/repository/sf-class2-root.crt
- Sf-class2-root.crt 파일 이름을 sf-class2-root.pem(확장자만 변경)으로 변경합니다.
- Data Domain 시스템 관리자 GUI를 사용하여 인증서를 가져옵니다.
- 클라우드 장치: "Data Management" > "File System" > "Cloud Units" > "Manage Certificates" > Add
- DDVE: "Administration" > "Access" > "MANAGE CA CERTIFICATES" > "+ Add
- 그런 다음 CLI 2단계를 실행합니다. (이 스크린샷 아래에 위치)
또는 CLI에서
- SCP 또는 SFTP 메소드를 사용하여 sf-class2-root.pem을 /ddr/var/certificates로 전송합니다.
- 인증서를 가져옵니다.
# adminaccess certificate import ca application cloud file sf-class2-root.pem
- 참고: 이 인증서는 GUI 또는 'adminaccess certificate show' 출력에서 제목이 비어 있는 것으로 표시될 수 있습니다. 이는 무시해도 됩니다(빈 디스플레이를 제외하고는 기능 문제가 없음).
sysadmin@dd01# adminaccess certificate show
Subject Type Application Valid From Valid Until Fingerprint
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
dd01.example.com imported-host ddboost Sat Jun 20 15:09:16 2020 Thu Jun 19 15:09:16 2025 12:DB:62:AA:E8:59:5B:E9:63:29:A0:DC:6B:63:B2:BB:E5:77:07:C6
avamar.example.com imported-ca login-auth Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
avamar.example.com imported-ca ddboost Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
- imported-ca cloud Tue Jun 29 10:39:16 2004 Thu Jun 29 10:39:16 2034 AD:7E:1C:28:B0:64:EF:8F:60:03:40:20:14:C3:D0:E3:37:0E:B5:8A
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
Certificate signing request (CSR) exists at /ddvar/certificates/CertificateSigningRequest.csr
Subject Type Application Valid From Valid Until Fingerprint
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
dd01.example.com imported-host ddboost Sat Jun 20 15:09:16 2020 Thu Jun 19 15:09:16 2025 12:DB:62:AA:E8:59:5B:E9:63:29:A0:DC:6B:63:B2:BB:E5:77:07:C6
avamar.example.com imported-ca login-auth Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
avamar.example.com imported-ca ddboost Fri Jun 19 17:25:13 2020 Wed Jun 18 17:25:13 2025 D8:03:BB:B0:31:C4:6D:E5:9E:14:92:A8:E2:36:99:3E:97:BB:31:25
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
- imported-ca cloud Tue Jun 29 10:39:16 2004 Thu Jun 29 10:39:16 2034 AD:7E:1C:28:B0:64:EF:8F:60:03:40:20:14:C3:D0:E3:37:0E:B5:8A
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
Certificate signing request (CSR) exists at /ddvar/certificates/CertificateSigningRequest.csr
- 이전 "Baltimore CyberTrust Root" 인증서를 제거하지 마십시오. AWS가 다시 Baltimore 인증서로 되돌려진 경우도 있었습니다.
- 새 Starfield 인증서와 함께 보관하십시오.
Affected Products
Data Domain, PowerProtect Data Protection SoftwareArticle Properties
Article Number: 000184415
Article Type: Solution
Last Modified: 22 Aug 2022
Version: 13
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.