PPDM: Updating a Data Domain certificate in PPDM using the 'ppcp' utility returns the message "new fingerprint is <nil>"

Summary: Updating a Data Domain certificate in PPDM using the ppcp utility returns the message "new fingerprint is "

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

When running ./ppcp certs update --host datadomain_hostname --port 3009 output returned shows: 
admin@PPDM:~> ppcp certs update --host data_domain_hostname --port 3009                                                                                                                                    ===========================================================
PPCP  :  0.39
PPDM  :  19.18.0-14
Date  :  12 Jan 2025 11:54 EST
===========================================================
Found existing certificate with ID Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Deleting old certificate
Delete URL :  certificates/Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Fetching New Certificate
Accepting New Certificate
PUT URL :  certificates/Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Certificate has be updated, old fingerprint was 8D40621ED938D1E7C308C8B83AEB873511F3F0D6 new fingerprint is <nil>


The command appears to run successfully, but the new fingerprint is <nil>

Curl command confirms that https certificate is expired.

admin@PPDM:~> curl -lv https://DataDomain_hostname:3009 [DataDomain_hostname] -k
*   Trying 10.25.224.123:3009...
* Connected to DataDomain_hostname (10.25.224.123) port 3009 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: C=US; ST=CA; O=Valued DataDomain customer; CN=DataDomain_hostname
*  start date: Jan 12 13:52:52 2022 GMT
*  expire date: Jan 11 21:52:52 2025 GMT
*  issuer: C=US; ST=CA; L=City; O=Valued Datadomain Customer; CN=DataDomain_hostname
*  SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* using HTTP/1.x
> GET / HTTP/1.1
> Host: DataDomain_hostname:3009
> User-Agent: curl/8.0.1
> Accept: */*
 

Log in to the Data Domain UI fails or the page shows as unavailable.
 

Cause

The https certificate on Data Domain is expired so it must be renewed first.

Resolution

Use KB 000198864: Data Domain: Web UI Inaccessible Due to Expired https Certificate to renew the https certs on Data Domain.

Once the certificate is renewed retry to update the Data Domain certificate in PowerProtect Data Manager using ppcp. 
#1
Set up ppcp script permission.
Run:


admin@my-ppdm:~> sudo chmod 755 /home/admin/bin/ppcp
admin@my-ppdm:~> cd /home/admin/bin/ppcp
  

#2
List the Certificates - To validate the port: 3009 and state showing expired
Run:


admin@PPDM:~> ppcp certs list
===========================================================
PPCP  :  0.39
PPDM  :  19.18.0-14
Date  :  12 Jan 2025 11:14 EST
===========================================================
                       id                      |          host           | port |               fingerprint                |  state   | type
-----------------------------------------------+-------------------------+------+------------------------------------------+----------+-------
    Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q= | DataDomain_hostname  | 3009 | 8D40621ED938D1E7C308C8B83AEB873511F3F0D6 | EXPIRED  | HOST
  
#3
Perform certs update command to update the Data Domain certificate. This renews the certificate and removes the expired instance.
Run:


admin@my-ppdm:~> ./ppcp certs update --host DataDomain_hostname --port 3009

This should provide output showing a new fingerprint.
  
admin@PPDM:~> ppcp certs update --host data_domain_hostname --port 3009                                                                                                                                    ===========================================================
PPCP  :  0.39
PPDM  :  19.18.0-14
Date  :  12 Jan 2025 11:54 EST
===========================================================
Found existing certificate with ID Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Deleting old certificate
Delete URL :  certificates/Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Fetching New Certificate
Accepting New Certificate
PUT URL :  certificates/Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q=
Certificate has be updated, old fingerprint was 8D40621ED938D1E7C308C8B83AEB873511F3F0D6 new fingerprint is 6C5E421ED938C5D9C308C8B83AEB873511CD4325

Certificate status should now be 'Accepted'.
  
admin@PPDM:~> ppcp certs list
===========================================================
PPCP  :  0.39
PPDM  :  19.18.0-14
Date  :  12 Jan 2025 11:14 EST
===========================================================
                       id                      |          host           | port |               fingerprint                |  state   | type
-----------------------------------------------+-------------------------+------+------------------------------------------+----------+-------
    Y2LKiS1kbWMwMS5jb250cmFucy5jYTozMDA5Omhvc3Q= | DataDomain_hostname  | 3009 | 6C5E421ED938C5D9C308C8B83AEB873511CD4325 | ACCEPTED  | HOST

Affected Products

PowerProtect Data Manager
Article Properties
Article Number: 000272447
Article Type: Solution
Last Modified: 08 Apr 2025
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.