PowerProtect：PPDM 的证书颁发机构（CA）功能

Summary: 随着 PPDM 19.16 修补程序 2 的发布，提供了启用 PPDM 证书颁发机构（CA）功能的功能。这支持使用中间证书颁发机构（中间 CA）对证书签名请求（CSR）进行签名。此增强功能让用户能够将自签名证书替换为客户签名的 CA。这允许灵活且安全的证书颁发过程。这允许集成分层证书结构，并将自签名证书替换为客户 CA 证书。

Instructions

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.

Check out other resources

Instructions

前提条件：

部署最新的 PPDM OVA（19.17 或 19.16 修补程序 2）
完成 UI 安装

提醒：此工作流只能在第 1 天配置中的 PPDM 上执行。

初始配置是指仅 R16 修补程序 2 和 R17 版本的全新安装支持 ICA 更换。部署 PPDM OVA 并配置设备后：在添加任何资产源、注册应用程序代理、部署代理、报告、搜索等之前，请替换 ICA。

以下步骤可用于更改证书颁发机构（CA）。

有三个选项可用于执行 ICA 更换工作流（UI、API 或手动）。建议客户使用 UI 方法，因为其他方法需要专业知识。

提醒：在开始工作流之前，请拍摄虚拟机的快照。如果更换工作流失败，则可以恢复。

选项 1 UI
1. 准备 icakey.pem 和 ica.pem 证书
2. 导航到AdministrationCertificatesInternalReplace >>> Certificates
3. 在表单“将 icakey.pem 上传到私有证书”文本框和“ica.pem 上传到公共证书链”文本框中，选中“中间证书颁发机构”复选框，然后单击“替换”

4.从 CLI 控制台监视日志中的进度，大约需要 15 分钟才能完成

tail -f /var/log/brs/secretsmgr/ppdm_certs_regeneration.log

（提醒：在 ICA 更换期间，PPDM 将进入维护模式，UI 将重新启动，但更换仍在进行中，即使最初 UI 重新打开，因此用户应通过控制台监视日志文件以确认它已完成。控制台输出

从日志确认更换完成后，刷新浏览器并确认证书已更换，方法是单击地址栏旁边的“不安全”按钮，单击证书无效选项，选择详细信息选项卡并确认证书为 4 级（前 2 级显示“公司名称”根 CA，第三级显示 PPDM SSL ICA、而最后一个是具有相应 PPDM 主机名并由 PPDM SSL ICA 签名的主机证书。
证书 UI

选项 2 — API

API

POST /api/v2/certificates-replacement

{
    "privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIEoQIBAAKCAQEAlM6nRceKg70ZfOQB3lCguOD78Uu7dw1jhhv4gbz54gBPGNvb\n4tR2vVs9uLq0Ugrv/ryhA/mcM9LYIOsAInyb360LoHdDXrtQwjtI76dPycINtQPL\nawhzuwb9A2qQz7yhfb8r+FOdHv++FSfnTMbKjrsU5ED7xL5EH4m3R6QExBxIAbQ+\nhHT78OzYOXJ2f1vq3UfbNDp6JHaWx4X3Mdqxe9aPGpKscvgzgj8sVGkAbVBI1pja\nTnH9Kuu4+N1JYxnMLD/gxQXouQf2GEDSqRriUmjC0AZEDgjccrGrNhB4xpITGt9m\nDLPiWPcsrESbcfswKSqw+l6C+BYNyz4Yu6mjGwIDAQABAoIBAD92MH1AX7DWPR/3\np1pV/W1LOfdKqnzX32lq1V0TKGh7ZEBAR3Lh1G/mERkOuudAVeDINk0ZL0Yktdq4\nDhsnFFzcklhRdJBah1MGcJEQRCVR1oGryB1yAdUx4kaKNI77rc2QcaKamigFvl2M\nYobqQqmDXKIJmrXpxOjEVT8+0m+Fz5KlOYJBLXyPVyxx6+VYfB1ckpZimZduYvhU\nwliDbTR8TDWn3ePu+dxDJ0vn7HAueds7rl4SbHt8MJmG6X33mOddrY3Yb+IY4F8T\nhNPYApBPENmDTs6KZj2J2BH0j+LCorPXWrEZZCz+A6OFebXJVTjxgjk6so6zUoHh\nF2q44nECgYEAynu10x95J16shIS47yvg/WqnmZr+2PpHvrs3H1DG5Hnpx/MvpxWK\nqYVyoDl84E7VTpmOu/i4Xnha6PDjnC6F+QCpq3nnrkCLIoRXx4ifBfElYoTIYu6a\ne8FhKY4DvSILs1+li62EOXbESQHfug6mW0/KIxYEpotJqiqAYHA/OxECgYEAvCMm\n+vtL6cS8GZ6A0d4DJD2VE+Oa+D9M1SgDU8HdQTVxGgdAHAzLZtA02o3/rqIoB6L+\nARmzdbEbledc/KjU/rpfHFV7ZBJ9sTwxJZ8kJHFnyIEGLaQ/2HKNvGSNlqr7aIGZ\naGzOLt9ilxRC/RVk0tmQFKuIE52h+YrKLIdew2sCgYBnVOy8elJUwh7eXfEWtVjT\nWqt/Wzb1OfyFHHuL8qgdjw28KaHG7dpemqidldjhi7mVrA3IZayJIXibadtuJ9vc\n7/ameMbACVY33jwBqvokiSTf+w1cV5Hk2BIip8PGsGoyNvx/pKRWwwJ2k4s+Ix3I\neZaZgzIKYAjO23O6Q24xUQJ/TG37Z/qu3EkQIVhC/P80R4S9C1drnW4ZyH54243m\nVJdhWzGW2c5Y02vCDQei108I9BFDHy9RuH46tqtHG117KgCMovYXKpBYf6f0T1RX\nWna3sry3xdL0HPpsmhw/aPYNLGd56vJI0MHvS3DvxeDrFL1NyxfkMBPZuYaom25j\nEQKBgQCOQfWCVNRLkKU4A0XpSm28mPbE7RBAa2kOaLN+0/+QenS/N52Otm5Xxglh\nxMe6BKsixKyyKvYbIZy6cMTqlekm0QrAzQ1EmSRLjjU3XNFNP3ov1YfuES6lCTCG\nw1lx/S7PcXRdu5pNXUbIQpy6yCGsLh6m1eSTu2bf5WHLA15btw==\n-----END RSA PRIVATE KEY-----",
    "certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEVzCCAz+gAwIBAgITZQAAAA34NqE9lzculAAAAAAADTANBgkqhkiG9w0BAQsF\nADCBljELMAkGA1UEBhMCVVMxFDASBgNVBAoTC1dlbGxzIEZhcmdvMS4wLAYDVQQL\nEyVXZWxscyBGYXJnbyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVzMUEwPwYDVQQD\nEzhXZWxscyBGYXJnbyBVQVQgRW50ZXJwcmlzZSBDZXJ0aWZpY2F0aW9uIEF1dGhv\ncml0eSAwNyBHMjAeFw0yNDAzMDUxOTE3MzNaFw0yNDA5MDExOTE3MzNaMDcxCzAJ\nBgNVBAYTAlVTMREwDwYDVQQKEwhEZWxsIEluYzEVMBMGA1UEAxMMUFBETSBTU0wg\nSUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlM6nRceKg70ZfOQB\n3lCguOD78Uu7dw1jhhv4gbz54gBPGNvb4tR2vVs9uLq0Ugrv/ryhA/mcM9LYIOsA\nInyb360LoHdDXrtQwjtI76dPycINtQPLawhzuwb9A2qQz7yhfb8r+FOdHv++FSfn\nTMbKjrsU5ED7xL5EH4m3R6QExBxIAbQ+hHT78OzYOXJ2f1vq3UfbNDp6JHaWx4X3\nMdqxe9aPGpKscvgzgj8sVGkAbVBI1pjaTnH9Kuu4+N1JYxnMLD/gxQXouQf2GEDS\nqRriUmjC0AZEDgjccrGrNhB4xpITGt9mDLPiWPcsrESbcfswKSqw+l6C+BYNyz4Y\nu6mjGwIDAQABo4H7MIH4MB0GA1UdDgQWBBQQmJK76/JdEv7oaVoy4Vz5BGgU3TAL\nBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBSNnzOv\nK+vTfkMNSXlZPsItKVaqOTBBBgNVHR8EOjA4MDagNKAyhjBodHRwOi8vY3JsLnVh\ndC5wa2kud2VsbHNmYXJnby5jb20vZW50VUFUMDdHMi5jcmwwUgYIKwYBBQUHAQEE\nRjBEMEIGCCsGAQUFBzAChjZodHRwOi8vY3JsLnVhdC5wa2kud2VsbHNmYXJnby5j\nb20vd2ZfZW50X1VBVF8wN19HMi5jcnQwDQYJKoZIhvcNAQELBQADggEBAEJGZIOy\nFeanvLBngWPdrb6ldyKPyurIS6xA4d0dqBg9rf/kd+aWdCqX2RduQ1rDBFFHpSEj\n8uuAOC4fsPykBogssr6UZBHXHfj6eLKZPlHBGBNMD+eGIqMXSjhB8NFZhC3Wpi5K\nk5Nz4kE+xkmYDQscjA/YUGdLmfUid3uKyTde/vkiQAxSGhdbazLyY1MCYv619JmY\n+kugGVGHFZyLMryba5aN2AvocYq7LVnTkjhAKIU/XBZtIfH9ukjBcO3GS8O3jvT0\nHxVSUlvXgTWgnzh/gFIPjeB9MX0M0qrorkVnXjFqks1Iyp4EfE0xMA39R5xpnr7P\n3yMjyIM05mN0Fgs=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFIzCCBAugAwIBAgIKYRo5WAAAAAAADjANBgkqhkiG9w0BAQsFADCBjjELMAkG\nA1UEBhMCVVMxFDASBgNVBAoTC1dlbGxzIEZhcmdvMSwwKgYDVQQLEyNXZWxscyBG\nYXJnbyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE7MDkGA1UEAxMyV2VsbHMgRmFy\nZ28gVUFUIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMDEgRzIwHhcNMTUw\nNDE0MTYzNjU1WhcNMjUwNDE0MTY0NjU1WjCBljELMAkGA1UEBhMCVVMxFDASBgNV\nBAoTC1dlbGxzIEZhcmdvMS4wLAYDVQQLEyVXZWxscyBGYXJnbyBDZXJ0aWZpY2F0\naW9uIEF1dGhvcml0aWVzMUEwPwYDVQQDEzhXZWxscyBGYXJnbyBVQVQgRW50ZXJw\ncmlzZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAwNyBHMjCCASIwDQYJKoZIhvcN\nAQEBBQADggEPADCCAQoCggEBAMeRSOl/GPcUJ+Ta+AbmJMNdJlheXC6JhnjkaqIK\nZxYpMBgcikl6DynHiBLK92BBCdsfwzwX5vSyK1a7Us9Q3nznANLPRHjkwbrsUE+1\nq/zQhW4gDELUf1UxGRhfHEhrqebif355qyIuyhBlsYAxPsbGDtDyYZP1NvhQ9doW\nwTO05+DGDZ+a1wJJd4lX4hL4f4YMHSLLxE4yYnSargD/p/SWzsCzXVPJEcFXtAH/\nNYQAHPvbnyVkK4+dFZVh2mBGxS4YJqPTQO81eLfLclk4qfxhMHcezXoGjNP45oSu\nZweRM7FDj28uYJxT+Z4ptAlO0UQG9eL1M9ygxw5QWDC/7QkCAwEAAaOCAXcwggFz\nMA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUjZ8zryvr035DDUl5WT7CLSlWqjkw\nTAYDVR0gBEUwQzBBBgtghkgBhvt7g3QAATAyMDAGCCsGAQUFBwIBFiRodHRwOi8v\nd3d3LndlbGxzZmFyZ28uY29tL3JlcG9zaXRvcnkwEgYDVR0TAQH/BAgwBgEB/wIB\nATAfBgNVHSMEGDAWgBTgCykWYjfg6E5VvlTV8FJHtEIf/TBCBgNVHR8EOzA5MDeg\nNaAzhjFodHRwOi8vY3JsLnVhdC5wa2kud2VsbHNmYXJnby5jb20vcm9vdFVBVDAx\nRzIuY3JsMHsGCCsGAQUFBwEBBG8wbTBABggrBgEFBQcwAoY0aHR0cDovL2NybC51\nYXQucGtpLndlbGxzZmFyZ28uY29tL3dmX3Jvb3RVQVQwMUcyLmNydDApBggrBgEF\nBQcwAYYdaHR0cDovL2t1cnJvcy53ZWxsc2ZhcmdvLmNvbS8wDQYJKoZIhvcNAQEL\nBQADggEBAAfcgl9ae+uy3r3f1i1Uliz2zfq3uFGTKjYIjZwBSANHiwC0zTEtV1uM\nhjKzzFr2EEkP9rRMMwO6rkW6HFqd0FMA/4vPOLjQIYwMbdOzZ96Nwi8jayUC/nG8\nqXFgFe2d0GXAv+KCRni2rjbeaUXPIESuNC0NcQfF2j+lxNMATMdHO9V/cZQJTgwb\nTXSux3346QTflwy2Q5tLGlVAWY24+qkRAtZrIIV+JqERAe9VTQB/n1TVjMkRaYna\nN1Yu/twnGkVDzfrIzR0vRP9P4WzhS+CDxa6ETVYpuqFCs3q1v7kT4/yUt1zPW89T\nSoqRj1lIGpyQ5WjeyMFxndJUcAxQhj8=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIID6jCCAtKgAwIBAgIQa3trjM5yKrFF9DkQc8L4tTANBgkqhkiG9w0BAQsFADCB\njjELMAkGA1UEBhMCVVMxFDASBgNVBAoTC1dlbGxzIEZhcmdvMSwwKgYDVQQLEyNX\nZWxscyBGYXJnbyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE7MDkGA1UEAxMyV2Vs\nbHMgRmFyZ28gVUFUIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMDEgRzIw\nHhcNMTIwNzA5MTcyMDQ2WhcNMjgxMjI1MTczMDM0WjCBjjELMAkGA1UEBhMCVVMx\nFDASBgNVBAoTC1dlbGxzIEZhcmdvMSwwKgYDVQQLEyNXZWxscyBGYXJnbyBDZXJ0\naWZpY2F0aW9uIEF1dGhvcml0eTE7MDkGA1UEAxMyV2VsbHMgRmFyZ28gVUFUIFJv\nb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgMDEgRzIwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDRsKnXacptFMAlFMGx/tb99tLsd1upkvHZEW7L8wCk\no74RuPemSceBg7+6CQVbRr+RMRKRpNH7Bj9RWPHcvGrqw6/L0YSAYJ7Dq67ktx7g\nfxkjAj7Chmk0GWTnJtc4DI5auz/Quq7WX09LGxDBSD2a3mEGU6aWmab9phFc8awA\njI0qrIQKuVj6KXaE5GSEQOKQHOJAOexDYL34EKW9dDt02/fmUFemRokk3bKCM1vM\nwBGcKSCBt5+ErRP79a0H3ySRitBw4y9xiZQ+oeU8rLosrWIc09Iu0GrehrGI04ut\nu7nsc/VzbdO2yOlfN2h7EJ8UNmNMu4wmmsBCICZjSe4fAgMBAAGjQjBAMA4GA1Ud\nDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTgCykWYjfg6E5V\nvlTV8FJHtEIf/TANBgkqhkiG9w0BAQsFAAOCAQEAGEsQ069iBxq+e4/FJqAMbY+m\n6xcViFkmtOtJAayV18mBzH4IngzA0OJrXtuv5GtEH25DFq6znqDX1aR0w1Fg7EKd\nlYNPlzRG8HW/m0Kjb2zXq2nAFbS6zOc9FxWcU0jQ2O9fHpV33RSJkYyP9nUm4U2N\nGXCmGJNL+pk6YwugL+VKb0i9IEbr193QasJsY9l++SfGffA9eOIzgIt4fLoXNYnQ\nrTK70DAnIVakHyh/b+WwhACgkKep3mb5D88NlR7vwvgOjTN45DyIy0SAwvbKVEre\nkFSCIa4pzuwJa2h+Z5h9Q3V/1Jaa9MS6kXP9jRZwogFuyt/nvyNur9uu01Yj5A==\n-----END CERTIFICATE-----",
    "ica": true
}

从 CLI 控制台监视日志中的进度，大约需要 15 分钟才能完成
tail -f /var/log/brs/secretsmgr/ppdm_certs_regeneration.log

在此 ICA 更换工作流中，PPDM 将进入维护模式，并且 UI 显示一条警告消息。在某个时间点，UI 会重新启动，并丢失警告消息。即使 UI 重新打开，更换仍在进行中。用户应通过控制台监视日志文件，以确认其是否已完成。
选项 3 - 手动通过 SSH 控制台
1. 此方法需要 CMD 工具以及可用的 .crt 和 .key 文件。有关此方法的进一步建议，请联系支持部门

Article Number: 000225966

Article Type: How To

Last Modified: 22 Jan 2026

Version: 4

Check if your device is covered by Support Services.

PowerProtect：PPDM 的证书颁发机构（CA）功能

Instructions

Instructions

Article Properties

Find answers to your questions from other Dell users

Support Services

Article Properties

Find answers to your questions from other Dell users

Support Services

PowerProtect：PPDM 的证书颁发机构 （CA） 功能

Detailed Article

Instructions

Instructions

Article Properties

Find answers to your questions from other Dell users

Support Services

Article Properties

Find answers to your questions from other Dell users

Support Services

PowerProtect：PPDM 的证书颁发机构（CA）功能