Avamar: Client Manager에 원격 Avamar Server를 추가할 수 없음

오류

Client Manager 웹 애플리케이션에서 원격 Avamar Server를 추가하려고 하면 다음 오류가 발생합니다.
 

Alert: Server authentication failed.

로그

다음 예외는 /usr/local/avamar-tomcat/logs/에서 캡처할 수 있습니다ACMTrace.log
 

2023-01-17 17:09:24,819 ERROR [ajp-nio-0:0:0:0:0:0:0:1-8509-exec-2]-sdk.ServiceConnection: Unable to connect to web service for grid remote_avamar.dell.com
org.apache.axis2.AxisFault: Socket is closed
        at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)
        at org.apache.axis2.transport.http.SOAPMessageFormatter.writeTo(SOAPMessageFormatter.java:83)
        at org.apache.axis2.transport.http.AxisRequestEntity.writeRequest(AxisRequestEntity.java:84)
        at org.apache.commons.httpclient.methods.EntityEnclosingMethod.writeRequestBody(EntityEnclosingMethod.java:499)
        at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2114)
        at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
        at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
        at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
        at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
        at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
        at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
        at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:346)
        at org.apache.axis2.transport.http.AbstractHTTPSender.executeMethod(AbstractHTTPSender.java:557)
        at org.apache.axis2.transport.http.HTTPSender.sendViaPost(HTTPSender.java:199)
        at org.apache.axis2.transport.http.HTTPSender.send(HTTPSender.java:76)
        at org.apache.axis2.transport.http.CommonsHTTPTransportSender.writeMessageWithCommons(CommonsHTTPTransportSender.java:400)
        at org.apache.axis2.transport.http.CommonsHTTPTransportSender.invoke(CommonsHTTPTransportSender.java:225)
        at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:438)
        at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:402)
        at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229)
        at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165)
        at com.avamar.mc.sdk.client.McServiceStub.login(McServiceStub.java:6088)
        at com.avamar.mc.sdk.client.McBaseServiceClient.login(McBaseServiceClient.java:120)
        at com.avamar.mc.sdk.client.McBaseServiceClient.connect(McBaseServiceClient.java:93)
        at com.emc.avamar.acm.core.mc.sdk.ServiceConnection.connect(ServiceConnection.java:67)
        at com.emc.avamar.acm.core.impl.WebServiceProxy.<init>(WebServiceProxy.java:152)
        at com.emc.avamar.acm.core.mapper.AvamarGridMapper.create(AvamarGridMapper.java:99)
        at com.emc.avamar.acm.core.entities.impl.DomainObjectImpl.create(DomainObjectImpl.java:86)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at com.emc.avamar.acm.core.entities.impl.DomainObjectImpl.invoke(DomainObjectImpl.java:50)
        at com.sun.proxy.$Proxy161.create(Unknown Source)
        at com.emc.avamar.acm.service.impl.GridServiceImpl.addGrid(GridServiceImpl.java:164)
        at com.emc.avamar.acm.action.common.AddGridAction.execute0(AddGridAction.java:68)
        at com.emc.avamar.acm.action.common.BaseServiceAction.execute(BaseServiceAction.java:56)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at com.opensymphony.xwork.DefaultActionInvocation.invokeAction(DefaultActionInvocation.java:358)
        at com.opensymphony.xwork.DefaultActionInvocation.invokeActionOnly(DefaultActionInvocation.java:218)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:192)
        at com.opensymphony.xwork.interceptor.DefaultWorkflowInterceptor.doIntercept(DefaultWorkflowInterceptor.java:175)
        at com.opensymphony.xwork.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:86)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.validator.ValidationInterceptor.doIntercept(ValidationInterceptor.java:115)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.validator.ValidationInterceptor.doIntercept(ValidationInterceptor.java:115)
        at com.opensymphony.xwork.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:86)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.webwork.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:174)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.webwork.interceptor.debugging.DebuggingInterceptor.intercept(DebuggingInterceptor.java:169)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:151)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.AroundInterceptor.intercept(AroundInterceptor.java:31)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:186)
        at com.opensymphony.xwork.DefaultActionInvocation.invoke(DefaultActionInvocation.java:190)
        at com.opensymphony.xwork.DefaultActionProxy.execute(DefaultActionProxy.java:116)
        at com.opensymphony.webwork.dispatcher.DispatcherUtils.serviceAction(DispatcherUtils.java:273)
        at com.opensymphony.webwork.dispatcher.FilterDispatcher.doFilter(FilterDispatcher.java:202)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at com.emc.avamar.filters.SecurityFilter.doFilter(SecurityFilter.java:35)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at com.emc.avamar.filters.AuthenticationFilter.doFilter(AuthenticationFilter.java:74)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at com.emc.avamar.filters.RedirectSecurityFilter.doFilter(RedirectSecurityFilter.java:18)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at com.emc.avamar.filters.RedirectSecurityFilter.doFilter(RedirectSecurityFilter.java:18)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:662)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:698)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:367)
        at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:526)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:882)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1647)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Unknown Source)
Caused by: com.ctc.wstx.exc.WstxIOException: Socket is closed
        at com.ctc.wstx.sw.BaseStreamWriter.finishDocument(BaseStreamWriter.java:1692)
        at com.ctc.wstx.sw.BaseStreamWriter.close(BaseStreamWriter.java:288)
        at org.apache.axiom.util.stax.wrapper.XMLStreamWriterWrapper.close(XMLStreamWriterWrapper.java:46)
        at org.apache.axiom.om.impl.MTOMXMLStreamWriter.close(MTOMXMLStreamWriter.java:188)
        at org.apache.axiom.om.impl.llom.OMSerializableImpl.serializeAndConsume(OMSerializableImpl.java:197)
        at org.apache.axis2.transport.http.SOAPMessageFormatter.writeTo(SOAPMessageFormatter.java:79)
        ... 101 more
Caused by: java.net.SocketException: Socket is closed
        at com.rsa.sslj.x.ap.l(Unknown Source)
        at com.rsa.sslj.x.ap.a(Unknown Source)
        at com.rsa.sslj.x.ap.a(Unknown Source)
        at com.rsa.sslj.x.am.write(Unknown Source)
        at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
        at java.io.BufferedOutputStream.flush(Unknown Source)
        at org.apache.commons.httpclient.ChunkedOutputStream.flush(ChunkedOutputStream.java:191)
        at com.ctc.wstx.io.UTF8Writer.flush(UTF8Writer.java:99)
        at com.ctc.wstx.sw.BufferingXmlWriter.flush(BufferingXmlWriter.java:214)
        at com.ctc.wstx.sw.BufferingXmlWriter.close(BufferingXmlWriter.java:194)
        at com.ctc.wstx.sw.BaseStreamWriter.finishDocument(BaseStreamWriter.java:1690)
        ... 106 more

tcpdump/wireshark

소스 Client Manager에서 저장을 클릭하여 서버를 추가하기 전에 소스 Avamar의 기본 인터페이스에서 tcpdump를 수행하여 추가하려는 원격 Avamar의 소스 또는 대상 IP가 있는 패킷만 캡처합니다.

예:
tcpdump -i <primary_interface> host <remote_avamar> -w <capture_file_output>
tcpdump -i bond0 host remote_avamar.dell.com -w /home/admin/client_manager.pcapng

tcpdump dump 명령을 실행하여 네트워크 트래픽 캡처를 시작합니다.
명령을 시작한 후 Client Manager 페이지에서 save를 클릭하여 원격 Avamar를 추가해 봅니다.
인증 오류가 발생하면 tcpdump를 CTRL C하여 패킷 캡처를 중지합니다.

이제 Wireshark와 같은 도구에서 tcpdump를 보고 조사합니다.

예:
연결 흐름 설명:
- 포트 9443에서 원격 Avamar로의 처음 3개 패킷에서 TCP 3방향 핸드셰이크(MCSDK 웹 서비스)
- 4번째 패킷 TLS 핸드셰이크는 소스 Avamar가 해당 기능을 대상으로 전송하는 Client Hello로 시작됩니다.
- 5번째 패킷 원격 Avamar가 패킷 4
를 확인함 - 6번째 패킷 원격 Avamar가 인증서 체인과 함께 Server Hello를 전송합니다. 인증서 체인은 /usr/local/avamar/lib/rmi_ssl_keystore
- 7번째 패킷, 소스 Avamar가 패킷을 확인합니다. 6
- 8번째 패킷, 소스 Avamar가 TLS 심각 알림을 발생시킴 42(잘못된 인증서)



확인해야

함 이 KB를 계속하기 전에 다음 몇 가지 사항을 확인해야 합니다.

- 소스 및 원격 Avamar Server
간의 정방향 및 역방향 DNS 조회 확인 - 원격 Avamar MCUser 계정에
올바른 자격 증명을 사용하여 확인 - /usr/local/avamar/var/mc/server_log/mcserver.out
을 조사하여 로컬 계정이 있는 소스 Avamar Server에 문제가 없는지 확인합니다. - 소스와 원격 Avamar 간에 포트 9443이 열려 있는지 확인합니다. 이는 mcsdk에 사용됩니다.

소스 Avamar Server가 포트 9443에서 원격 Avamar Server의 mcssl 인증서를 검증할 수 없습니다.
이 연결 중에 소스 Avamar는 자체 신뢰 저장소 /usr/local/avamar/lib/rmi_ssl_keystore를 사용하여 원격 Avamar Server의 mcssl 인증서를 검증하려고 시도합니다.
원격 Avamar의 mcssl이 소스 Avamar의 rmi 키 저장소에 없는 경우 TLS 핸드셰이크 실패 후 소켓이 닫힙니다(증상의 tcpdump 분석 참조).

다음과 같은 두 가지 시나리오가 있습니다.

1. 추가되는 원격 Avamar Server에 자체 서명된 웹 인증서가 있습니다(MCSSL이 RMI 키 저장소에서 자체 서명됨).
2. 추가되는 원격 Avamar Server에 CA 서명 웹 인증서가 있습니다(mcssl은 전체 체인으로 연결된 서명된 인증서임).

자체 서명되었는지 CA 서명 mcssl인지 어떻게 알 수 있습니까?
- 시스템 탭에서 개인 키를 대체하여 AUI에 서명된 인증서를 설치한 경우 mcssl이 서명
됩니다. 그렇지 않은 경우 인증서가 자체 서명

될 수 있음 Avamar Server에서 RMI 키 저장소의 mcssl 인증서를 보려면 다음 명령을 사용합니다.

keytool -list -v -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias mcssl

자체 서명된 mcssl의 예:
아래에서 체인 길이에 인증서가 하나만 있고 소유자와 발급자가 동일한 개체(관리자)임을 확인할 수 있습니다.


CA 서명 mcssl의 예:
아래에서 mcssl의 체인 길이가 3임을 확인할 수 있습니다.
체인에 있는 각 인증서의 소유자 및 발급자는 신뢰할 수 있는 루트 CA(Dell Tech Root CA 2018)에 연결됩니다.



시나리오 1

단계:

1. SSH를 통해 소스 Avamar Server

2에 연결합니다. openssl을 사용하여 원격 mcssl 인증서 가져오기

echo | openssl s_client -connect <remote_avamar_ip_addr>:9443 | openssl x509 > /home/admin/remote_mcssl.crt

3. 원격 mcssl 인증서를 rmi 키 저장소로 가져오기

keytool -import -file /home/admin/remote_mcssl.crt -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias remotemcssl

4. admin 사용자로 mcs 재시작

mcserver.sh --restart --force

5. 루트 사용자로 tomcat을 다시 시작합니다.

emwebapp.sh --restart

6. 필요한 경우 백업 스케줄러를 다시 시작하십시오.

dpnctl start sched

시나리오 2

단계:

1. SSH를 통해 소스 Avamar Server

2에 연결합니다. 원격 mcssl 인증서

에 대한 체인에서 CA 인증서 가져오기 - CA 공급자로부터 중간 CA 및 루트 CA를 가져올 수 있는 액세스 권한이 있는 경우 개별 파일을 Avamar Server에 배치하여 rmi 키 저장소
로 가져옵니다. 이 KB에서는 openssl을 사용하여 원격 Avamar mcssl에서 전체 인증서 체인을 가져오는 방법에 대해 설명합니다.
 

echo | openssl s_client -connect <remote_avamar_ip_addr>:9443 -showcerts

예시 출력:

root@source_avamar:/home/admin/#: echo | openssl s_client -connect <remote_avamar_ip_addr>:9443 -showcerts
CONNECTED(00000003)
depth=2 C = US, ST = Texas, L = Round Rock, O = Dell Technologies, OU = Cybersecurity, CN = Dell Technologies Root Certificate Authority 2018
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/C=US/ST=Raleigh/L=North Carolina/O=Dell/OU=ISG Support/CN=remote_avamar.dell.com
   i:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/CN=Dell Technologies Issuing CA 101
-----BEGIN CERTIFICATE-----
MIIFhjCCBG6gAwIBAgITYQABIryZXAGxuzqHpgAAAAEivDANBgkqhkiG9w0BAQsF
ADB5MQswCQYDVQQGEwJVUzEOMAwGA1UECBMFVGV4YXMxEzARBgNVBAcTClJvdW5k
IFJvY2sxGjAYBgNVBAoTEURlbGwgVGVjaG5vbG9naWVzMSkwJwYDVQQDEyBEZWxs
IFRlY2hub2xvZ2llcyBJc3N1aW5nIENBIDEwMTAeFw0yMjEyMjkxNTUyMzRaFw0y
NDEyMjkxNjAyMzRaMIGNMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHUmFsZWlnaDEX
MBUGA1UEBxMOTm9ydGggQ2Fyb2xpbmExDTALBgNVBAoTBERlbGwxFDASBgNVBAsT
C0lTRyBTdXBwb3J0MS4wLAYDVQQDEyVhdm1yLTQ0MDAtcnRwLmRwYWQuZ3NsYWJz
LmxhYi5lbWMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxwou
w833CQTH+BVANqyS4pPBjz6/0jU0vGHu4Hz5L9/hPen0Nk8H6hmc2h0nMCfs5Q27
9I1YdP0XyY+fNt2qmXTFQ+pQ5e23QKLnRRo3NLxlPt0J8L9ju8WtHIcgmPnxd7zp
/9h5CDkdhJ73d0+bkXU+nj9TbLtGrX1xbxgEfGuth4ofTZuYar9uyDMZSsTnklI9
8/sInptiHMS9+u55RDCRt68PfkLY0MJooPbTsH08HVcI6Y3OHxivdEHf2tGDcHLM
x5onF6pw6e0l7Z1b0OXf6wdwrhDUoinfIFNDMOWFU3K0gWqToTu+TtL90ZaZy0zW
SHVtP5yKDzBthjBpwwIDAQABo4IB8DCCAewwPwYDVR0RBDgwNoIlYXZtci00NDAw
LXJ0cC5kcGFkLmdzbGFicy5sYWIuZW1jLmNvbYINYXZtci00NDAwLXJ0cDAdBgNV
HQ4EFgQU7Gix38z9pC5bfb/kIZD/Dv1xMOAwHwYDVR0jBBgwFoAUUwwDUHFz+sTs
UVOMRSttymBWk7YwXQYDVR0fBFYwVDBSoFCgToZMaHR0cDovL2NybC5kZWxsLmNv
bS9pbnQvaXNzdWluZy9EZWxsJTIwVGVjaG5vbG9naWVzJTIwSXNzdWluZyUyMENB
JTIwMTAxLmNybDBoBggrBgEFBQcBAQRcMFowWAYIKwYBBQUHMAKGTGh0dHA6Ly9h
aWEuZGVsbC5jb20vaW50L2lzc3VpbmcvRGVsbCUyMFRlY2hub2xvZ2llcyUyMElz
c3VpbmclMjBDQSUyMDEwMS5jcnQwDAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCBaAw
PQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIh7jZbIGE+AiGvY0PhfOANYKzmVoz
g9fvaoHFyVgCAWQCARwwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCcG
CSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwEwCgYIKwYBBQUHAwIwDQYJKoZIhvcN
AQELBQADggEBAFW4PGDJT4KwLfEKVv1xRapUrFjIdWpZUjnuBEYk7RXlQ7o0OBM6
wKmwJHuiM5kLnlCMeQgPHyDtrzQVWMAwzw9RP0sFm+OdQklarVc5CqNoj0n+agN1
jbknUwyN2av2XBM7GF+CSXFDILteyVQmEsb3QD11khEU4pXGasIm/3R7Tm4uY7qq
dtARJeSr0m/uFeaT2AONBZn2uy/EIomzJanB3FI2sLu7UcaoQ1VqsH0c9PZbWAkv
tUYVBHxOD79PUiEQWgajHFPwanmUuzwlZpWxr09z0Yqjx623ZpdkMwP7jVV+tJXF
yfJoP0EuL3NvyROwvwu4CWhUIiJ26Q6+ACI=
-----END CERTIFICATE-----
 1 s:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/CN=Dell Technologies Issuing CA 101
   i:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/OU=Cybersecurity/CN=Dell Technologies Root Certificate Authority 2018
-----BEGIN CERTIFICATE-----
MIIFNjCCBB6gAwIBAgITEwAAAAJT0lQwmqXBWgAAAAAAAjANBgkqhkiG9w0BAQsF
ADCBojELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFzMRMwEQYDVQQHEwpSb3Vu
ZCBSb2NrMRowGAYDVQQKExFEZWxsIFRlY2hub2xvZ2llczEWMBQGA1UECxMNQ3li
ZXJzZWN1cml0eTE6MDgGA1UEAxMxRGVsbCBUZWNobm9sb2dpZXMgUm9vdCBDZXJ0
aWZpY2F0ZSBBdXRob3JpdHkgMjAxODAeFw0xODExMTQyMTI2MzVaFw0yNTExMTQy
MTM2MzVaMHkxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczETMBEGA1UEBxMK
Um91bmQgUm9jazEaMBgGA1UEChMRRGVsbCBUZWNobm9sb2dpZXMxKTAnBgNVBAMT
IERlbGwgVGVjaG5vbG9naWVzIElzc3VpbmcgQ0EgMTAxMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEAs1ijUZedCGDMDz4vpkxEO2JRi7Q3f5WE8m8emZFX
0393V+ekbyJZnEB3RLLPJiIy+YDgctJMLU51GenChujMJklk7gk+SKwqL+2p30vJ
Dpwz7Lsl7Cjn3v1vQ5AxEHkkUKL0H6NsRZ7uJKrPsH1cVvQtcpgZCg4ghdGB92wE
AIlSVYRPN07T/QkmD3EFSEdNEISFNk4KljIlRmpxprEN7hKyUv002COvN5S6zXMs
9GFPdnbTEaiZpFPtRF+ZZn0ub0i16Us0IRE60xHEllWyKWJYNhiW+srztLR/eP6a
1J4EIImvNz32pxrKDbIeQZxQAH9FVQqJpssSgN8LJzNXnwIDAQABo4IBizCCAYcw
EAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFFMMA1Bxc/rE7FFTjEUrbcpgVpO2
MBEGA1UdIAQKMAgwBgYEVR0gADAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL
BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTbAOslX5H7
mca2SBzQY61f4qe0VjBtBgNVHR8EZjBkMGKgYKBehlxodHRwOi8vY3JsLmRlbGwu
Y29tL2ludC9yb290L0RlbGwlMjBUZWNobm9sb2dpZXMlMjBSb290JTIwQ2VydGlm
aWNhdGUlMjBBdXRob3JpdHklMjAyMDE4LmNybDB4BggrBgEFBQcBAQRsMGowaAYI
KwYBBQUHMAKGXGh0dHA6Ly9haWEuZGVsbC5jb20vaW50L3Jvb3QvRGVsbCUyMFRl
Y2hub2xvZ2llcyUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSUyMDIw
MTguY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQCAJoPC4DTuxgC/wAHcHHvstGfiP/sB
/moVVdyOabZ7jSk+Pr2UjBPsALcfnwEsqxeL25J5Hn112baDTnVvrcymdqo9gD/5
tkrWUOWwrvzuwCuB082qHcbWdaOJtoLyuYdobPDktShKc43Oprv7G19TL3ccCmMJ
CPWGh4uv0D5vZnOh0T3wA591Gok6wJAKlXU3GCl5hiPII0j84DXE1kVDDSvDSF82
syl1wzha6gYe8s0S64NiB9eWofwJEHhZlam86+N6WQm1qBHdJ4kix5ndaa9sUJYG
ldHZZdACf5Cg9+/f/5sBiSpua0Id87TmKHu2Cm51LwAiLLbJYvexZbXz
-----END CERTIFICATE-----
 2 s:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/OU=Cybersecurity/CN=Dell Technologies Root Certificate Authority 2018
   i:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/OU=Cybersecurity/CN=Dell Technologies Root Certificate Authority 2018
-----BEGIN CERTIFICATE-----
MIIEITCCAwmgAwIBAgIQGRwh4YLNUKpNzFg7nT7QgjANBgkqhkiG9w0BAQsFADCB
ojELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFzMRMwEQYDVQQHEwpSb3VuZCBS
b2NrMRowGAYDVQQKExFEZWxsIFRlY2hub2xvZ2llczEWMBQGA1UECxMNQ3liZXJz
ZWN1cml0eTE6MDgGA1UEAxMxRGVsbCBUZWNobm9sb2dpZXMgUm9vdCBDZXJ0aWZp
Y2F0ZSBBdXRob3JpdHkgMjAxODAeFw0xODA3MjMxNzA3NDVaFw00MzA3MjMxNzE3
NDRaMIGiMQswCQYDVQQGEwJVUzEOMAwGA1UECBMFVGV4YXMxEzARBgNVBAcTClJv
dW5kIFJvY2sxGjAYBgNVBAoTEURlbGwgVGVjaG5vbG9naWVzMRYwFAYDVQQLEw1D
eWJlcnNlY3VyaXR5MTowOAYDVQQDEzFEZWxsIFRlY2hub2xvZ2llcyBSb290IENl
cnRpZmljYXRlIEF1dGhvcml0eSAyMDE4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAqlQlbFbW7/Iy6wVtPEmfxbRMliJj4S/0vboVuZySAYI7TtMBAaDu
gBBeKPuKmRD1nUP+T4L0i5KBUFRWq5OvgtDYk8Ig382douSbWe4dwGOvcjNKvbHf
Iki9cVSvgTjaeOtORYXzMlCLw59JT6FtXFKjlW1GrM+TPbb2rjDLNir0IzDYvPUx
INXXnxyBSaBvkTipChTnIqXJJG53xEZIb/tK4NE3vcuP5RTFE0AEZmdY9Ka06x8Y
3X83ifbFZ2ZNTjRYggWdVpXB1sdfhjskdUDHunlvN9xBdur4QIUhfsefpe8sVE0K
RAv7IFBKwo5X+zFrfFM9KZGRGQsCBhKWgwIDAQABo1EwTzALBgNVHQ8EBAMCAYYw
DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU2wDrJV+R+5nGtkgc0GOtX+KntFYw
EAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQELBQADggEBAKZ5Su5LLbOXtito
8OFAkOs/AxuzRPP16E1ZO8VWN8Q4y0RsCbJ7V+R1QAlhd793X1LnEMHYpnXQLPbg
tWtWcPfoZbVK5zcDCIt4/7XgpCmL6yGGk9SVDkJrZIv+bvlB6P64vR/Fs2BYHaQx
G2ITb2GN4CrU+UxmieBPMvj12epD23R8HIcarKD/ZRCAR3XAd80v2A5mncxSqdHI
PzNT/fmlMgiesEl+IjJqc98HCtVAVa2hLsXkiZiLGKZPmS0cbQTsW/sNBE+s5WlG
Yo++cDfTgqdLiYcTXmx9PPyMwbmzkUr8Mr8dbDBodWSEpVgv6oCej2kGOF6saUAr
/4YKU4g=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=Raleigh/L=North Carolina/O=Dell/OU=ISG Support/CN=remote_avamar.dell.com
issuer=/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/CN=Dell Technologies Issuing CA 101
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4353 bytes and written 459 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-SHA256
    Session-ID: 63D41D4F774A930BF695B94A53099134EF9DBC7B62B05595E1F82F4CC7CEA4AE
    Session-ID-ctx:
    Master-Key: 9CF0572465C0B5F72F2C4D19DF3EA5E5B5D27A37EA8A5C8EAD6656B7E362B80B1FF1F71E0BB07BE4CC9EAD393FCE2D30
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1674845514
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
DONE

출력에서 체인에 3개의 인증서가 있음을 알 수 있습니다.

순서대:

Server Cert
0 s:/C=US/ST=Raleigh/L=North Carolina/O=Dell/OU=ISG Support/CN=remote_avamar.dell.com

Intermediate CA
1 s:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/CN=Dell Technologies Issuing CA 101

Root CA
2 s:/C=US/ST=Texas/L=Round Rock/O=Dell Technologies/OU=Cybersecurity/CN=Dell Technologies Root Certificate Authority 2018

인증서의 내용은 -----BEGIN CERTIFICATE-----로 시작하고 -----END CERTIFICATE-----(포함

)로 끝납니다. 출력에서 두 번째 인증서(깊이 1의 중간 CA)를 가져와서 해당 내용을 remote_mcssl_int.crt

와 같은 파일에 저장합니다. 출력의 세 번째 인증서(깊이 2의 루트 CA)를 가져와서 해당 내용을 remote_mcssl_root.crt

와 같은 파일에 저장합니다.서명된 mcssl의 모든 길이 체인에 대해 이 프로세스를 수행하여 모든 중간 CA와 루트 CA를 개별 파일에 저장합니다.


3. 각 CA를 rmi 키 저장소로 가져오기
 

keytool -import -file /home/admin/remote_mcssl_int.crt -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias remoteMcsslInt

keytool -import -file /home/admin/remote_mcssl_root.crt -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias remoteMcsslRoot

4. admin 사용자로 mcs 재시작

mcserver.sh --restart --force

5. 루트 사용자로 tomcat을 다시 시작합니다.

emwebapp.sh --restart

6. 필요한 경우 백업 스케줄러를 다시 시작하십시오.

dpnctl start sched