Avamar：如何重新產生憑證
요약: 如何因為到期 （或設定錯誤） 而重設或重新產生憑證。
이 문서는 다음에 적용됩니다.
이 문서는 다음에 적용되지 않습니다.
이 문서는 특정 제품과 관련이 없습니다.
모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
지침
使用案例：
- 依需求重新產生憑證。
- 當 Avamar 服務中斷，且因憑證過期或設定錯誤而無法重新啟動時。
注意：
- 其中幾個過程需要重新啟動正在運行的服務。這可能會中斷執行中的備份和複寫工作。在 Avamar 維護 （檢查點 （cp）、檢查點驗證 （hfscheck） 或垃圾收集） 執行期間，不應重新啟動服務。
- 重新產生金鑰存放區和更新 Data Domain 憑證存放區可使用 GoAV 工具自動完成。如需詳細資訊，請參閱下列文章： Avamar：如何使用 goav 安全性金鑰存放區
- 如果要使用 GoAV 工具，請確定已根據 Avamar： 用於管理和故障診斷的 GoAV 產品工具下載並解壓縮最新副本
- 在執行任何更新之前， 必須 先使用檢查點。
檢閱現有的到期時間，以判斷需要哪些更新：
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
設定「storepath」變數：
適用於 Avamar v19.7 及更新版本：
storepath=/home/tomcat/.keystore
適用於 Avamar v19.4 及更低版本：
storepath=/home/admin/.keystore
-
執行下列命令以列印憑證到期日期：
storepass=`ask_pass -r keystore_passphrase` && echo "MC Root certificates: " && keytool -list -keystore /usr/local/avamar/lib/avamar_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "MCSDK certificate: " && keytool -list -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Admin/DTLT certificate: " && keytool -list -alias tomcat -keystore $storepath -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Avi certificate: " && keytool -list -alias tomcat -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Apache certificate: " && openssl x509 -in /etc/apache2/ssl.crt/server.crt -noout -dates
範例輸出 （根據在 2026 年 2 月 18 日執行的命令）：
MC Root certificates: Alias name: mcectls Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030 Alias name: mcrsatls Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2030 Alias name: mcecroot Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030 Alias name: mcrsaroot Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2030 MCSDK certificate: Alias name: mcssl Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035 Alias name: mcjwt Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035 Admin/DTLT certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035 Avi certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035 Apache certificate: notBefore=Feb 1 04:49:34 2022 GMT notAfter=Jan 31 04:49:34 2027 GMT
（上面的輸出顯示沒有任何內容過期）
MC Root certificates: Alias name: mcectls Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Mar 12 20:21:48 PST 2026 Alias name: mcrsatls Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Mar 12 20:21:50 PST 2026 Alias name: mcecroot Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Mar 12 20:21:48 PST 2026 Alias name: mcrsaroot Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Mar 12 20:21:49 PST 2026 MCSDK certificate: Alias name: mcssl Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035 Alias name: mcjwt Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035 Admin/DTLT certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035 Avi certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035 Apache certificate: notBefore=Feb 1 04:49:34 2022 GMT notAfter=Jan 31 04:49:34 2027 GMT
（以上輸出顯示 MC Root 憑證將在一個月內到期）
MC Root certificates: Alias name: mcectls Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2026 Alias name: mcrsatls Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2026 Alias name: mcecroot Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2026 Alias name: mcrsaroot Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2026 MCSDK certificate: Alias name: mcssl Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035 Alias name: mcjwt Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035 Admin/DTLT certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035 Avi certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035 Apache certificate: notBefore=Feb 1 04:49:34 2022 GMT notAfter=Jan 31 04:49:34 2027 GMT
（以上輸出顯示 MC Root 憑證已過期）
MC Root certificates: Alias name: mcectls Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030 Alias name: mcrsatls Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2030 Alias name: mcecroot Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030 Alias name: mcrsaroot Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2030 MCSDK certificate: Alias name: mcssl Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035 Alias name: mcjwt Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035 Admin/DTLT certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035 Avi certificate: Alias name: tomcat Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035 Apache certificate: notBefore=Feb 1 04:49:34 2021 GMT notAfter=Jan 31 04:49:34 2026 GMT
（以上輸出顯示 Apache 憑證已過期。）
更新下方附錄適用章節中的適當憑證：
- 僅重新產生 Apache 憑證
- 僅重新產生 Tomcat 憑證
- 僅重新產生 AVI 憑證
- 重新產生管理主控台伺服器 （MCS） 開發人員套件 （MCSDK） 憑證
- 重新產生管理主控台 （MC） 根憑證
- 重新產生所有憑證
執行變更後驗證：
-
確認所有 Avamar 服務都在執行中：
dpnctl status
- 執行測試備份
- 執行備份瀏覽以進行還原
附錄：
僅重新產生 Apache 憑證：
Apache 憑證會儲存為一般的隱私增強郵件 （PEM） 格式的憑證檔案。
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有認證檔案的備份複本：
cp -p /etc/apache2/ssl.crt/server.crt /etc/apache2/ssl.crt/server.crt.`date +%y%m%d` cp -p /etc/apache2/ssl.key/server.key /etc/apache2/ssl.key/server.key.`date +%y%m%d`
-
確認備份複本是否存在：
ls -al /etc/apache2/ssl.crt/server.crt* ls -al /etc/apache2/ssl.key/server.key*
-
Apache 憑證可以使用 GoAV （v18.4 及更新版本），或執行 Avamar 命令：「
GoAV」命令 （和範例輸出）：
./goav security certificate apache regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 04:52 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:./goav security certificate apache regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select a Key Size in bits: ┃ > 2048 ┃ 3072 ┃ 4096
（選取所需的金鑰大小，或採用預設值 2048）
Apache x509 Certificate Configuration ------------------------------------- Apache Private Key ------------------ Location /etc/apache2/ssl.key/server.key Modulus MD5sum 0d35d9c14239093d4f5e28bd5f2f98c8 Key Size 2048 Apache Server Cert ------------------ Location /etc/apache2/ssl.crt/server.crt Serial 129741042722659803976190762572696306257 Subject C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com Issuer C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com Valid Range YYYY/MM/DD - valid from: 2026/02/18, valid to: 2028/02/18 Modulus MD5sum 0d35d9c14239093d4f5e28bd5f2f98c8 Key Size 2048 Subject Alt Names server.company.com
-- 或 --
Avamar 命令 （和範例輸出）：
gen-ssl-cert --updateapache --noupdateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verboseopenssl genrsa -out /tmp/gen-ssl-cert-server.key.9085 3072 Generating RSA private key, 3072 bit long modulus e is 65537 (0x10001) openssl req -new -key /tmp/gen-ssl-cert-server.key.9085 -out /tmp/gen-ssl-cert-server.csr.9085 < /tmp/gen-ssl-cert-answers.9085 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ... |-30200 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start `-30206 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable. /sbin/service apache2 stop /sbin/service apache2 start
僅重新產生 Tomcat 憑證：
- Tomcat 金鑰存放區會儲存 Tomcat 憑證。
- 它會根據 Avamar 版本重新產生「/home/tomcat/.keystore」或「/home/admin/.keystore」。
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有金鑰存放區的備份複本：
cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d`
（在 Avamar 19.4 和更低版本中，將「/home/admin/.keystore」替換為「/home/tomcat/.keystore」）
-
確認備份複本是否存在：
ls -al /home/tomcat/.keystore*
（在 Avamar 19.4 和更低版本中，將「/home/admin/.keystore」替換為「/home/tomcat/.keystore」）
-
可以使用 GoAV 更新金鑰存放區，或透過在 Avamar 上執行命令來更新金鑰存放區：
“GoAV”命令（和示例輸出）：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ RMI_SSL_KEYSTORE ┃ AVAMAR_KEYSTORE ┃ AVI_KEYSTORE ┃ > TOMCAT_KEYSTORE
（選取「TOMCAT_KEYSTORE」）
⣯ Fixing any Tomcat issues ... ══════════════════ Fixing Keystore Issues ══════════════════ Regenerated Tomcat Keystore ✓ ═══════════════════ Restarting Services ═══════════════════ ┃ Tomcat restart required, restart Tomcat? ┃ ┃ yes no
（選擇“是”）
═══════════════════ Restarting Services ═══════════════════ ⣻ Restarting Tomcat... ... Tomcat restarted
-- 或 --
Avamar 命令：- 設定「tomcat_keystore」變數：
若為 Avamar v19.7 及更新版本：storepath=/home/tomcat/.keystore
適用於 Avamar v19.4 及更低版本：storepath=/home/admin/.keystore
- 執行下列命令，重新產生 Tomcat 金鑰存放區：
mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
- 更新金鑰存放區的權限和擁有權：
適用於 Avamar v19.7 及更新版本：chmod 640 $TOMCAT_KEYSTORE
chown root:tomcat $TOMCAT_KEYSTORE
適用於 Avamar v19.4 及更低版本：chmod 740 $TOMCAT_KEYSTORE
chown admin:admin $TOMCAT_KEYSTORE
- 設定「tomcat_keystore」變數：
僅重新產生 AVI 憑證：
重新產生「/usr/local/avamar/lib/avi/avi_keystore」
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有金鑰存放區的備份複本：
cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d`
-
確認備份複本是否存在：
ls -al /usr/local/avamar/lib/avi/avi_keystore*
-
可以使用 GoAV 更新金鑰存放區，或透過在 Avamar 上執行命令來更新金鑰存放區：
“GoAV”命令（和示例輸出）：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ RMI_SSL_KEYSTORE ┃ AVAMAR_KEYSTORE ┃ > AVI_KEYSTORE ┃ TOMCAT_KEYSTORE
（選取「AVI_KEYSTORE」）
... ══════════════════ Fixing Keystore Issues ══════════════════ Regenerated Avi Keystore ✓ ═══════════════════ Restarting Services ═══════════════════ ┃ Avinstaller restart required, restart AVI? ┃ ┃ yes no
（選擇“是”）
═══════════════════ Restarting Services ═══════════════════ ⣽ Restarting Avinstaller... ... Avinstaller restarted
-- 或 --
Avamar 命令 （和範例輸出）：
（服務會自動重新啟動）- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
- 重新產生憑證：
gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose
gen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US" gen-ssl-cert: INFO: Successfully created tomcat in java keystore gen-ssl-cert: INFO: Restarting avinstaller service gen-ssl-cert: INFO: avinstaller service restart complete gen-ssl-cert: INFO: Restarting LDLS service gen-ssl-cert: INFO: LDLS service restart complete
- 從「rmi_ssl_keystore」匯出別名：
keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
Certificate stored in file </tmp/mcssl.pem>
- 將別名匯入「avi_keystore」：
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Serial number: d93e3be Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036 Certificate fingerprints: SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01 Signature algorithm name: SHA512withRSA Subject Public Key Algorithm: 3072-bit RSA key Version: 3 Trust this certificate? [no]:
（選擇“y”）Certificate was added to keystore
- 更新權限和擁有權 （並驗證）：
chmod 644 /usr/local/avamar/lib/avi/avi_keystore
chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
ls -al /usr/local/avamar/lib/avi/avi_keystore
- 將目前的金鑰存放區移至一邊：
重新產生管理主控台伺服器 （MCS） 開發人員套件 （MCSDK） 憑證：
- 這會更新包含「MCSDK」憑證和「JWT」簽署金鑰的 Avamar RMI 金鑰存放區
- 它會重新產生「/usr/local/avamar/lib/rmi_ssl_keystore」
- 「MCSDK」憑證處理 Java 遠端方法調用 （RMI） 與 Data Protection Central （DPC）、Avamar Administrator Console、Proxy Deployment Manager （PDM） 和 Client Manager （AAM） 的通訊。
- Tomcat 憑證也應更新。Tomcat 金鑰存放區會儲存 Tomcat 憑證。
- 它會根據 Avamar 版本重新產生「/home/tomcat/.keystore」或「/home/admin/.keystore」
- AVI 憑證也應更新
- 它會重新產生「/usr/local/avamar/lib/avi/avi_keystore」
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有金鑰存放區的備份複本：
cp -p /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_ssl_keystore.`date +%y%m%d`
cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d`
cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d`
（在 Avamar 19.4 和更低版本中，將「/home/admin/.keystore」替換為「/home/tomcat/.keystore」）
-
確認備份複本是否存在：
ls -al /usr/local/avamar/lib/rmi_ssl_keystore*
ls -al /usr/local/avamar/lib/avi/avi_keystore*
ls -al /home/tomcat/.keystore*
（在 Avamar 19.4 和更低版本中，將「/home/admin/.keystore」替換為「/home/tomcat/.keystore」）
-
備份 MCS：
- 切換到管理員
- 執行下列命令以執行 MCS 備份 （亦即排清）：
mcserver.sh --flush=== BEGIN === check.mcs (preflush) check.mcs passed === PASS === check.mcs PASSED OVERALL (preflush) Flushing Administrator Server... Administrator Server flushed.
- 輸入 exit 以返回根工作階段。
-
可以使用 GoAV 更新金鑰存放區，或透過在 Avamar 上執行命令來更新金鑰存放區：
“GoAV”命令（和示例輸出）：
- MCSDK：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ > RMI_SSL_KEYSTORE ┃ AVAMAR_KEYSTORE ┃ AVI_KEYSTORE ┃ TOMCAT_KEYSTORE
（選取「RMI_SSL_KEYSTORE」）⣯ Stopping MCS... ... ══════════════════ Fixing Keystore Issues ══════════════════ Regenerated RMI Keystore ✓ ══════ Loading vCenter Certificates into RMI Keystore ══════ ═══════════════════ Restarting Services ═══════════════════ ┃ MCS restart required, restart MCS? ┃ ┃ yes no
（選擇“是”）═══════════════════ Restarting Services ═══════════════════ ┃ Do you wish to restart the backup scheduler? ┃ ┃ yes no
（選擇“是”）
如果在 MCS 重新啟動期間收到下列訊息：unable to take mcs flush: The Administrator Server is not running. ERROR: Cannot flush the Administrator Server while it is not running. Start the Administrator Server first.
- 重新啟動 MCS：
dpnctl start MCS - 重新啟動備份排程器：
dpnctl start sched
- 重新啟動 MCS：
- Tomcat：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ RMI_SSL_KEYSTORE ┃ AVAMAR_KEYSTORE ┃ AVI_KEYSTORE ┃ > TOMCAT_KEYSTORE
（選取「TOMCAT_KEYSTORE」）⣯ Fixing any Tomcat issues ... ══════════════════ Fixing Keystore Issues ══════════════════ Regenerated Tomcat Keystore ✓ ═══════════════════ Restarting Services ═══════════════════ ┃ Tomcat restart required, restart Tomcat? ┃ ┃ yes no
（選擇“是”）═══════════════════ Restarting Services ═══════════════════ ⣻ Restarting Tomcat... ... Tomcat restarted
- 阿維：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ RMI_SSL_KEYSTORE ┃ AVAMAR_KEYSTORE ┃ > AVI_KEYSTORE ┃ TOMCAT_KEYSTORE
（選取「AVI_KEYSTORE」）... ══════════════════ Fixing Keystore Issues ══════════════════ Regenerated Avi Keystore ✓ ═══════════════════ Restarting Services ═══════════════════ ┃ Avinstaller restart required, restart AVI? ┃ ┃ yes no
（選擇“是”）═══════════════════ Restarting Services ═══════════════════ ⣽ Restarting Avinstaller... ... Avinstaller restarted
-- 或 --
Avamar 命令 （和範例輸出）：- MCSDK：
- 將目前的金鑰庫移到一邊：
mv /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_keystore-$(date -I) - 重新產生金鑰存放區：
keytool -genkeypair -v -alias mcssl -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
keytool -genkeypair -v -alias mcjwt -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
- 更新權限和擁有權 （並驗證）：
chown root:admin /usr/local/avamar/lib/rmi_ssl+keystore
chmod 660 /usr/local/avamar/lib/rmi_ssl+keystore
ls -al /usr/local/avamar/lib/rmi_ssl+keystore
- 以系統管理員身分重新開機 MCS 並啟動備份排程器：
mcserver.sh --stop
mcuserver.sh --start
dpnctl start sched
- 將目前的金鑰庫移到一邊：
- Tomcat：
- 設定「tomcat_keystore」變數：
若為 Avamar v19.7 及更新版本：storepath=/home/tomcat/.keystore
適用於 Avamar v19.4 及更低版本：storepath=/home/admin/.keystore
- 執行下列命令，重新產生 Tomcat 金鑰存放區：
mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
- 更新金鑰存放區的權限和擁有權：
適用於 Avamar v19.7 及更新版本：chmod 640 $TOMCAT_KEYSTORE
chown root:tomcat $TOMCAT_KEYSTORE
適用於 Avamar v19.4 及更低版本：chmod 740 $TOMCAT_KEYSTORE
chown admin:admin $TOMCAT_KEYSTORE
- 設定「tomcat_keystore」變數：
- 阿維：
- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I) - 重新產生金鑰存放區：
gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbosegen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US" gen-ssl-cert: INFO: Successfully created tomcat in java keystore gen-ssl-cert: INFO: Restarting avinstaller service gen-ssl-cert: INFO: avinstaller service restart complete gen-ssl-cert: INFO: Restarting LDLS service gen-ssl-cert: INFO: LDLS service restart complete
- 從「rmi_ssl_keystore」匯出別名：
keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
Certificate stored in file </tmp/mcssl.pem>
- 將別名匯入「avi_keystore」：
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase)Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Serial number: d93e3be Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036 Certificate fingerprints: SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01 Signature algorithm name: SHA512withRSA Subject Public Key Algorithm: 3072-bit RSA key Version: 3 Trust this certificate? [no]:
（選擇“y”）Certificate was added to keystore
- 更新權限和擁有權 （並驗證）：
chmod 644 /usr/local/avamar/lib/avi/avi_keystore
chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
ls -al /usr/local/avamar/lib/avi/avi_keystore
- 將目前的金鑰存放區移至一邊：
- MCSDK：
重新產生管理主控台服務 （MCS） 根憑證：
- 此步驟會更新所有 MCS 根憑證。
- 它會重新產生「/usr/local/avamar/lib/avamar_keystore」
- 這些憑證只有在已到期或即將到期時才應更新。
- 如果啟用工作階段安全性，則會影響用戶端的備份、還原和複寫。
- 全球儲存區域網路 （
GSAN） 還必須重新生成證書。
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有金鑰存放區的備份複本：
cp -p /usr/local/avamar/lib/avamar_keystore /usr/local/avamar/lib/avamar_keystore.`date +%y%m%d`
-
確認備份複本是否存在：
ls -al /usr/local/avamar/lib/avamar_keystore*
-
備份 MCS：
- 切換到管理員
- 執行下列命令以執行 MCS 備份 （亦即排清）：
mcserver.sh --flush=== BEGIN === check.mcs (preflush) check.mcs passed === PASS === check.mcs PASSED OVERALL (preflush) Flushing Administrator Server... Administrator Server flushed.
- 輸入 exit 以返回根工作階段。
-
可以使用 GoAV 更新金鑰存放區，或透過在 Avamar 上執行命令來更新金鑰存放區：
“GoAV”命令（和示例輸出）：
./goav security keystore regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav security keystore ║ ║ regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select Keystore to Regenerate ┃ RMI_SSL_KEYSTORE ┃ > AVAMAR_KEYSTORE ┃ AVI_KEYSTORE ┃ TOMCAT_KEYSTORE
（選取「AVAMAR_KEYSTORE」）
⣯ Stopping MCS... ... ══════════════════ Fixing Keystore Issues ══════════════════ ⢿ Fixing any AVAMAR_KEYSTORE issues... Regenerated Avamar Keystore ✓ ═══════════════════ Restarting Services ═══════════════════ ┃ MCS restart required, restart MCS? ┃ ┃ yes no ←/→ toggle • enter submit • y yes • n no
（選擇“是”）
═══════════════════ Restarting Services ═══════════════════ ┃ Do you wish to restart the backup scheduler? ┃ ┃ yes no
（選擇“是”）
如果在 MCS 重新啟動期間收到下列訊息：
unable to take mcs flush: The Administrator Server is not running. ERROR: Cannot flush the Administrator Server while it is not running. Start the Administrator Server first.
- 重新啟動 MCS：
dpnctl start MCS - 重新啟動備份排程器：
dpnctl start sched
-- 或 --
Avamar 命令 （和範例輸出）：- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I) - 重新產生金鑰存放區：
mcrootca allINFO: Executing mcrootca... INFO: Initializing, may take a few moments... INFO: Generating, saving and verifying MC EC root key and certificate... INFO: Successfully generated, saved and verified MC EC root key and certificate. INFO: Generating and saving EC TLS key and certificate... INFO: Successfully generated and saved EC TLS key and certificate. INFO: Verifying EC TLS certificate... INFO: Successfully verified EC TLS certificate. INFO: Test loading EC CA certificate(s)... INFO: Successfully loaded EC CA certificate(s)... INFO: Verifying EC CA certificate(s)... INFO: Successfully verified EC CA certificate(s)... INFO: Setting EC root key and certificate as new... INFO: Successfully set EC root key and certificate as new. INFO: Generating, saving and verifying MC RSA root key and certificate... INFO: Successfully generated, saved and verified MC RSA root key and certificate. INFO: Generating and saving RSA TLS key and certificate... INFO: Successfully generated and saved RSA TLS key and certificate. INFO: Verifying RSA TLS certificate... INFO: Successfully verified RSA TLS certificate. INFO: Test loading RSA CA certificate(s)... INFO: Successfully loaded RSA CA certificate(s)... INFO: Verifying RSA CA certificate(s)... INFO: Successfully verified RSA CA certificate(s)... INFO: Test loading TLS certificate... INFO: Successfully loaded TLS certificate. INFO: Verifying TLS certificate... INFO: Successfully verified TLS certificate. INFO: Setting RSA root key and certificate as new... INFO: Successfully set RSA root key and certificate as new. INFO: mcrootca exited with return value = 0
- 以系統管理員身分重新開機 MCS 並啟動備份排程器：
mcserver.sh --stop
mcuserver.sh --start
dpnctl start sched
- 重新啟動 MCS：
-
重新產生 GSAN 憑證：
- 備份「/usr/local/avamar/etc/directory」：
tar -cvf /home/admin/avamar_etc_bk.`date +%y%m%d` /usr/local/avamar/etc/ - 執行下列命令：
enable_secure_config.sh --certs
- 備份「/usr/local/avamar/etc/directory」：
-
更新 Data Domain （DD） 憑證存放區：
這可以使用GoAV實用程式完成，也可以手動執行。
GoAV」命令 （和範例輸出）：
./goav dd check-ssl --fix╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav dd check-ssl --fix ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ Session Security Enabled PASSED DDR Security Feature Manual Flag PASSED DDR Host Cert Auto Refresh Flag PASSED GSAN Cert Chain Expiration PASSED GSAN Server Cert Expiration PASSED Get Attached Data Domains PASSED Check DDR Key exists PASSED Test Port 22: dl003.company.com PASSED Test ddr_key ssh auth: dl003.company.com PASSED DD/Avamar time difference: dl003.company.com PASSED DD SCP enabled: dl003.company.com PASSED DD NFS enabled: dl003.company.com PASSED DD system passphrase is set: dl003.company.com PASSED DD imported-host ddboost: dl003.company.com PASSED DD host issuer is attached: dl003.company.com PASSED Av chain.pem imported to DD: dl003.company.com FAILED avamar gsan chain.pem does not exist on Data Domain TASK: Delete imported-host ddboost DONE TASK: Load gsan chain depth 0 DONE TASK: Delete imported ca/login auth DONE TASK: Restart ddboost DONE TASK: Stop MCS DONE TASK: Start MCS DONE TASK: Sync Data Domain DONE Backup Scheduler Status FAILED Removed /usr/local/avamar/etc/10.n.n.16 ✓ Removed /usr/local/avamar/etc/client/10.n.n.16 ✓ Generating new certificates... "/usr/local/avamar/var/.avagent" avagent Info <19803>: Ignoring the --service flag. avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 2025/01/18-18:20:51.46677 [avagent] <1291> FIPS mode enabled avagent Info <42249>: Checking for stale certificate lock avagent Info <19805>: Creating directory '/usr/local/avamar/etc/10.n.n.16' for certificates avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/10.n.n.16' avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none) avagent Info <18918>: Registration: Processing secure registration with the MCS. avagent Info <18921>: Registration: Requesting root CA from the MCS. avagent Info <18926>: Registration: Saving root CA. avagent Info <18928>: Registration: Creating certificate signing request. avagent Info <18930>: Registration: Sending the certificate signing request to the MCS. avagent Info <18932>: Registration: Saving client certificate. avagent Info <18934>: Registration: Secure registration complete. avagent Info <41048>: Requesting network configuration from the MCS. avagent Info <5405>: avagent returning with exitcode 0 2026/02/18-18:20:52.13501 [avagent] Config: VARDIR=/usr/local/avamar/var, HOMEDIR=/root 2026/02/18-18:20:52.13506 [avagent] Looking for flag file "/usr/local/avamar/var/avamar.cmd" 2026/02/18-18:20:52.13509 [avagent] Looking for flag file "/usr/local/avamar/var/avagent.cmd" 2026/02/18-18:20:52.13517 [avagent] Looking for flag file "/usr/local/avamar/var/.avagent" avagent Info <19803>: Ignoring the --service flag. avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client 2026/02/18-18:20:52.14446 [avagent] <1291> FIPS mode enabled avagent Info <42249>: Checking for stale certificate lock avagent Info <19805>: Creating directory '/usr/local/avamar/etc/client/10.n.n.16' for certificates avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/client/10.n.n.16' avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none) avagent Info <18918>: Registration: Processing secure registration with the MCS. avagent Info <18921>: Registration: Requesting root CA from the MCS. avagent Info <18926>: Registration: Saving root CA. avagent Info <18928>: Registration: Creating certificate signing request. avagent Info <18930>: Registration: Sending the certificate signing request to the MCS. avagent Info <18932>: Registration: Saving client certificate. avagent Info <18934>: Registration: Secure registration complete. avagent Info <41048>: Requesting network configuration from the MCS. avagent Info <5405>: avagent returning with exitcode 0 Generated certificates for 10.n.n.16 ✓ Testing Avtar connection... avtar Info <5551>: Command Line: /usr/local/avamar/bin/avtar.bin --flagfile=/usr/local/avamar/etc/usersettings.cfg --server=avacrk003 --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --id=root --password=**************** --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --sysdir=/usr/local/avamar/etc --backups --account=/MC_BACKUPS --count=10 --encrypt=tls avtar Info <7977>: Starting at 2026-02-18 18:20:53 GMT [avtar Dec 8 2023 07:07:43 19.10.100-135 Linux-x86_64] avtar Info <6555>: Initializing connection avtar Info <5552>: Connecting to Avamar Server (avacrk003) avtar Info <5554>: Connecting to one node in each datacenter avtar Info <5583>: Login User: "root", Domain: "default", Account: "/MC_BACKUPS" avtar Info <5580>: Logging in on connection 0 (server 0) avtar Info <5582>: Avamar Server login successful avtar Info <10632>: Using Client-ID='6638d648ef621aa9dc20be40ab49e0820dac9b39' avtar Info <5550>: Successfully logged into Avamar Server [19.10.0-135] avtar Info <19849>: Selecting 10 backups avtar Info <7377>: Backups for /MC_BACKUPS as of 2025-11-25 18:20:53 GMT avtar Info <5314>: Command completed (exit code 0: success) Date Time Seq Label Size Plugin Working directory Targets 2026-02-18 18:15:56 3726 2034984K Linux /usr/local/avamar var/mc/server_data 2026-02-17 18:08:30 3725 2034952K Linux /usr/local/avamar var/mc/server_data 2026-02-16 17:31:43 3724 2033952K Linux /usr/local/avamar var/mc/server_data 2026-02-15 08:00:31 3723 1035390K Linux /usr/local/avamar var/mc/server_data 2026-02-14 07:45:20 3722 1035346K Linux /usr/local/avamar var/mc/server_data 2026-02-13 08:00:29 3721 1035313K Linux /usr/local/avamar var/mc/server_data 2026-02-12 07:45:19 3720 1035269K Linux /usr/local/avamar var/mc/server_data 2026-02-11 08:00:30 3719 1035419K Linux /usr/local/avamar var/mc/server_data 2026-02-10 07:45:18 3718 1035377K Linux /usr/local/avamar var/mc/server_data 2026-02-09 08:00:30 3717 1035511K Linux /usr/local/avamar var/mc/server_data-- 或 --
手動步驟（和示例輸出）：- 請遵循解決方案路徑文章中的「案例 1 」：Avamar AUI 中的 DD 顯示紅色
- 為「avtar」產生一組新的用戶端憑證 （如果存在）。
檢查「/usr/local/avamar/etc」和「/usr/local/avamar/etc/client」中的用戶端憑證：cd /usr/local/avamar/etc/$(hostname -i)
cd /usr/local/avamar/etc/client/$(hostname -i)
- 如果 兩個命令都 回報「沒有此類檔案或目錄」，則表示 Avamar 未使用用戶端憑證。移至步驟 9。
- 如果 存在任一 目錄，請按照下面的步驟 c-e 操作。
- 移除現有的用戶端憑證目錄：
注意： 複製以下命令，如下所示。請勿修改它們。
rm -r /usr/local/avamar/etc/$(hostname -i)
rm -r /usr/local/avamar/etc/client/$(hostname -i)
- 僅為上述現有目錄產生「avtar」的一組新用戶端憑證：
avagent.bin --gencerts=true --mcsaddr=$(hostname -i)
avagent.bin --gencerts=true --mcsaddr=$(hostname -i) --sysdir=/usr/local/avamar/etc/client
- 測試連線，以確認 avtar 是否可以連線至「GSAN」：
avtar --backups --path=/MC_BACKUPS --count=5 --encrypt=tls
-
重新註冊所有用戶端和 VMware Proxy：
- 重新註冊代理程式型用戶端：
mccli client re-register-all - 重新註冊 VMware 代理，方法是從 Avamar 集中重新開機：
mccli mcs reboot-proxy --all
- 重新註冊代理程式型用戶端：
重新產生所有憑證：
將重新產生上面記錄的所有憑證和金鑰庫
-
以系統管理員身分登入 Avamar 工具節點。
-
提升至 root 權限。
-
製作現有金鑰存放區的備份複本：
cp -p /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_ssl_keystore.`date +%y%m%d` cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d` cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d` cp -p /etc/apache2/ssl.crt/server.crt /etc/apache2/ssl.crt/server.crt.`date +%y%m%d` cp -p /etc/apache2/ssl.key/server.key /etc/apache2/ssl.key/server.key.`date +%y%m%d` cp -p /usr/local/avamar/lib/avamar_keystore /usr/local/avamar/lib/avamar_keystore.`date +%y%m%d`
-
確認備份複本是否存在：
ls -al /usr/local/avamar/lib/rmi_ssl_keystore* ls -al /usr/local/avamar/lib/avi/avi_keystore* ls -al/home/tomcat/.keystore* ls -al /etc/apache2/ssl.crt/server.crt* ls -al /etc/apache2/ssl.key/server.key* ls -al/usr/local/avamar/lib/avamar_keystore*
（同樣，請在 Avamar 19.4 和更低版本中將「/home/admin/.keystore」替換為「/home/admin/.keystore」）
-
備份 MCS：
- 切換到管理員
- 執行下列命令以執行 MCS 備份 （亦即排清）：
mcserver.sh --flush=== BEGIN === check.mcs (preflush) check.mcs passed === PASS === check.mcs PASSED OVERALL (preflush) Flushing Administrator Server... Administrator Server flushed.
- 輸入 exit 以返回根工作階段。
-
GOAV 可用來一次重新產生所有金鑰存放區，或是在 Avamar 上執行命令：
GoAV 命令 （和範例輸出）：
- 重新產生所有金鑰存放區：
./goav security keystore regenerate all╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 19 Feb 2026 05:33 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:./goav security keystore regenerate --all ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ⣯ Stopping MCS... ... Regenerated RMI Keystore ✓ Regenerated Avamar Keystore ✓ Regenerated Avi Keystore ✓ Regenerated Tomcat Keystore ✓ ══════ Loading vCenter Certificates into RMI Keystore ══════ ═══════════════════ Restarting Services ═══════════════════ ┃ MCS restart required, restart MCS? ┃ ┃ yes no
（選擇“是”）═══════════════════ Restarting Services ═══════════════════ ┃ Do you wish to restart the backup scheduler? ┃ ┃ yes no
（選擇“是”）
如果在 MCS 重新啟動期間收到下列訊息：unable to take mcs flush: The Administrator Server is not running. ERROR: Cannot flush the Administrator Server while it is not running. Start the Administrator Server first.
- 重新啟動 MCS：
dpnctl start MCS - 重新啟動備份排程器：
dpnctl start sched
- 重新啟動 MCS：
- 重新產生 Apache 憑證：
./goav security certificate apache regenerate╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 04:52 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:./goav security certificate apache regenerate ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ ┃ Select a Key Size in bits: ┃ > 2048 ┃ 3072 ┃ 4096
（選取所需的金鑰大小，或採用預設值 2048）Apache x509 Certificate Configuration ------------------------------------- Apache Private Key ------------------ Location /etc/apache2/ssl.key/server.key Modulus MD5sum 0d35d9c14239093d4f5e28bd5f2f98c8 Key Size 2048 Apache Server Cert ------------------ Location /etc/apache2/ssl.crt/server.crt Serial 129741042722659803976190762572696306257 Subject C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com Issuer C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com Valid Range YYYY/MM/DD - valid from: 2026/02/18, valid to: 2028/02/18 Modulus MD5sum 0d35d9c14239093d4f5e28bd5f2f98c8 Key Size 2048 Subject Alt Names server.company.com
-- 或 --
Avamar 命令 （和範例輸出）：- MCS Root 憑證：
- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I) - 重新產生金鑰存放區：
mcrootca allINFO: Executing mcrootca... INFO: Initializing, may take a few moments... INFO: Generating, saving and verifying MC EC root key and certificate... INFO: Successfully generated, saved and verified MC EC root key and certificate. INFO: Generating and saving EC TLS key and certificate... INFO: Successfully generated and saved EC TLS key and certificate. INFO: Verifying EC TLS certificate... INFO: Successfully verified EC TLS certificate. INFO: Test loading EC CA certificate(s)... INFO: Successfully loaded EC CA certificate(s)... INFO: Verifying EC CA certificate(s)... INFO: Successfully verified EC CA certificate(s)... INFO: Setting EC root key and certificate as new... INFO: Successfully set EC root key and certificate as new. INFO: Generating, saving and verifying MC RSA root key and certificate... INFO: Successfully generated, saved and verified MC RSA root key and certificate. INFO: Generating and saving RSA TLS key and certificate... INFO: Successfully generated and saved RSA TLS key and certificate. INFO: Verifying RSA TLS certificate... INFO: Successfully verified RSA TLS certificate. INFO: Test loading RSA CA certificate(s)... INFO: Successfully loaded RSA CA certificate(s)... INFO: Verifying RSA CA certificate(s)... INFO: Successfully verified RSA CA certificate(s)... INFO: Test loading TLS certificate... INFO: Successfully loaded TLS certificate. INFO: Verifying TLS certificate... INFO: Successfully verified TLS certificate. INFO: Setting RSA root key and certificate as new... INFO: Successfully set RSA root key and certificate as new. INFO: mcrootca exited with return value = 0
- 以系統管理員身分重新開機 MCS 並啟動備份排程器：
mcserver.sh --stop
mcuserver.sh --start
dpnctl start sched
- 將目前的金鑰存放區移至一邊：
- MCSDK：
- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_keystore-$(date -I) - 重新產生金鑰存放區：
keytool -genkeypair -v -alias mcssl -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
keytool -genkeypair -v -alias mcjwt -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
- 更新權限和擁有權 （並驗證）：
chown root:admin /usr/local/avamar/lib/rmi_ssl+keystore
chmod 660 /usr/local/avamar/lib/rmi_ssl+keystore
ls -al /usr/local/avamar/lib/rmi_ssl_keystore
- 以系統管理員身分重新開機 MCS 並啟動備份排程器：
mcserver.sh --stop
mcuserver.sh --start
dpnctl start sched
- 將目前的金鑰存放區移至一邊：
- Tomcat：
- 設定「tomcat_keystore」變數：
若為 Avamar v19.7 及更新版本：storepath=/home/tomcat/.keystore
適用於 Avamar v19.4 及更低版本：storepath=/home/admin/.keystore
- 執行下列命令，重新產生 Tomcat 金鑰存放區：
mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
- 更新金鑰存放區的權限和擁有權：
適用於 Avamar v19.7 及更新版本：chmod 640 $TOMCAT_KEYSTORE
chown root:tomcat $TOMCAT_KEYSTORE
適用於 Avamar v19.4 及更低版本：chmod 740 $TOMCAT_KEYSTORE
chown admin:admin $TOMCAT_KEYSTORE
- 設定「tomcat_keystore」變數：
- AVI：（服務自動重新啟動）
- 將目前的金鑰存放區移至一邊：
mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I) - 重新產生金鑰存放區：
gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbosegen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US" gen-ssl-cert: INFO: Successfully created tomcat in java keystore gen-ssl-cert: INFO: Restarting avinstaller service gen-ssl-cert: INFO: avinstaller service restart complete gen-ssl-cert: INFO: Restarting LDLS service gen-ssl-cert: INFO: LDLS service restart complete
- 從「rmi_ssl_keystore」匯出別名：
keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
Certificate stored in file </tmp/mcssl.pem>
- 將別名匯入「avi_keystore」：
keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase)Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US Serial number: d93e3be Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036 Certificate fingerprints: SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01 Signature algorithm name: SHA512withRSA Subject Public Key Algorithm: 3072-bit RSA key Version: 3 Trust this certificate? [no]:
（選擇“y”）Certificate was added to keystore
- 更新權限和擁有權 （並驗證）：
chmod 644 /usr/local/avamar/lib/avi/avi_keystore
chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
ls -al /usr/local/avamar/lib/avi/avi_keystore
- 將目前的金鑰存放區移至一邊：
- Apache：
gen-ssl-cert --updateapache --noupdateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verboseopenssl genrsa -out /tmp/gen-ssl-cert-server.key.9085 3072 Generating RSA private key, 3072 bit long modulus e is 65537 (0x10001) openssl req -new -key /tmp/gen-ssl-cert-server.key.9085 -out /tmp/gen-ssl-cert-server.csr.9085 < /tmp/gen-ssl-cert-answers.9085 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ... |-30200 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start `-30206 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable. /sbin/service apache2 stop /sbin/service apache2 start
- 重新產生所有金鑰存放區：
-
重新產生 GSAN 憑證：
- 備份「/usr/local/avamar/etc/directory」：
tar -cvf /home/admin/avamar_etc_bk.`date +%y%m%d` /usr/local/avamar/etc/ - 執行下列命令：
enable_secure_config.sh --certs
- 備份「/usr/local/avamar/etc/directory」：
-
更新 Data Domain （DD） 憑證存放區：
這可以使用GoAV實用程式完成，也可以手動執行。
GoAV」命令 （和範例輸出）：
./goav dd check-ssl --fix╔════════════════════════════════════════════════════════╗ ║ GoAV v2.02 ║ ╟────────────────────────────────────────────────────────╢ ║ Build : 02 Feb 2026 19:03 UTC ║ ║ Date : 18 Feb 2026 05:37 UTC ║ ║ Avamar: 19.4.100-124 ║ ╟────────────────────────────────────────────────────────╢ ║ Command:/home/admin/20260218/goav dd check-ssl --fix ║ ╟────────────────────────────────────────────────────────╢ ║ NOTE: This tool was created and is maintained ║ ║ by the ISG Support Tools team. ║ ╚════════════════════════════════════════════════════════╝ Session Security Enabled PASSED DDR Security Feature Manual Flag PASSED DDR Host Cert Auto Refresh Flag PASSED GSAN Cert Chain Expiration PASSED GSAN Server Cert Expiration PASSED Get Attached Data Domains PASSED Check DDR Key exists PASSED Test Port 22: dl003.company.com PASSED Test ddr_key ssh auth: dl003.company.com PASSED DD/Avamar time difference: dl003.company.com PASSED DD SCP enabled: dl003.company.com PASSED DD NFS enabled: dl003.company.com PASSED DD system passphrase is set: dl003.company.com PASSED DD imported-host ddboost: dl003.company.com PASSED DD host issuer is attached: dl003.company.com PASSED Av chain.pem imported to DD: dl003.company.com FAILED avamar gsan chain.pem does not exist on Data Domain TASK: Delete imported-host ddboost DONE TASK: Load gsan chain depth 0 DONE TASK: Delete imported ca/login auth DONE TASK: Restart ddboost DONE TASK: Stop MCS DONE TASK: Start MCS DONE TASK: Sync Data Domain DONE Backup Scheduler Status FAILED Removed /usr/local/avamar/etc/10.n.n.16 ✓ Removed /usr/local/avamar/etc/client/10.n.n.16 ✓ Generating new certificates... "/usr/local/avamar/var/.avagent" avagent Info <19803>: Ignoring the --service flag. avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 2025/01/18-18:20:51.46677 [avagent] <1291> FIPS mode enabled avagent Info <42249>: Checking for stale certificate lock avagent Info <19805>: Creating directory '/usr/local/avamar/etc/10.n.n.16' for certificates avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/10.n.n.16' avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none) avagent Info <18918>: Registration: Processing secure registration with the MCS. avagent Info <18921>: Registration: Requesting root CA from the MCS. avagent Info <18926>: Registration: Saving root CA. avagent Info <18928>: Registration: Creating certificate signing request. avagent Info <18930>: Registration: Sending the certificate signing request to the MCS. avagent Info <18932>: Registration: Saving client certificate. avagent Info <18934>: Registration: Secure registration complete. avagent Info <41048>: Requesting network configuration from the MCS. avagent Info <5405>: avagent returning with exitcode 0 2026/02/18-18:20:52.13501 [avagent] Config: VARDIR=/usr/local/avamar/var, HOMEDIR=/root 2026/02/18-18:20:52.13506 [avagent] Looking for flag file "/usr/local/avamar/var/avamar.cmd" 2026/02/18-18:20:52.13509 [avagent] Looking for flag file "/usr/local/avamar/var/avagent.cmd" 2026/02/18-18:20:52.13517 [avagent] Looking for flag file "/usr/local/avamar/var/.avagent" avagent Info <19803>: Ignoring the --service flag. avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client 2026/02/18-18:20:52.14446 [avagent] <1291> FIPS mode enabled avagent Info <42249>: Checking for stale certificate lock avagent Info <19805>: Creating directory '/usr/local/avamar/etc/client/10.n.n.16' for certificates avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/client/10.n.n.16' avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none) avagent Info <18918>: Registration: Processing secure registration with the MCS. avagent Info <18921>: Registration: Requesting root CA from the MCS. avagent Info <18926>: Registration: Saving root CA. avagent Info <18928>: Registration: Creating certificate signing request. avagent Info <18930>: Registration: Sending the certificate signing request to the MCS. avagent Info <18932>: Registration: Saving client certificate. avagent Info <18934>: Registration: Secure registration complete. avagent Info <41048>: Requesting network configuration from the MCS. avagent Info <5405>: avagent returning with exitcode 0 Generated certificates for 10.n.n.16 ✓ Testing Avtar connection... avtar Info <5551>: Command Line: /usr/local/avamar/bin/avtar.bin --flagfile=/usr/local/avamar/etc/usersettings.cfg --server=avacrk003 --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --id=root --password=**************** --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --sysdir=/usr/local/avamar/etc --backups --account=/MC_BACKUPS --count=10 --encrypt=tls avtar Info <7977>: Starting at 2026-02-18 18:20:53 GMT [avtar Dec 8 2023 07:07:43 19.10.100-135 Linux-x86_64] avtar Info <6555>: Initializing connection avtar Info <5552>: Connecting to Avamar Server (avacrk003) avtar Info <5554>: Connecting to one node in each datacenter avtar Info <5583>: Login User: "root", Domain: "default", Account: "/MC_BACKUPS" avtar Info <5580>: Logging in on connection 0 (server 0) avtar Info <5582>: Avamar Server login successful avtar Info <10632>: Using Client-ID='6638d648ef621aa9dc20be40ab49e0820dac9b39' avtar Info <5550>: Successfully logged into Avamar Server [19.10.0-135] avtar Info <19849>: Selecting 10 backups avtar Info <7377>: Backups for /MC_BACKUPS as of 2025-11-25 18:20:53 GMT avtar Info <5314>: Command completed (exit code 0: success) Date Time Seq Label Size Plugin Working directory Targets 2026-02-18 18:15:56 3726 2034984K Linux /usr/local/avamar var/mc/server_data 2026-02-17 18:08:30 3725 2034952K Linux /usr/local/avamar var/mc/server_data 2026-02-16 17:31:43 3724 2033952K Linux /usr/local/avamar var/mc/server_data 2026-02-15 08:00:31 3723 1035390K Linux /usr/local/avamar var/mc/server_data 2026-02-14 07:45:20 3722 1035346K Linux /usr/local/avamar var/mc/server_data 2026-02-13 08:00:29 3721 1035313K Linux /usr/local/avamar var/mc/server_data 2026-02-12 07:45:19 3720 1035269K Linux /usr/local/avamar var/mc/server_data 2026-02-11 08:00:30 3719 1035419K Linux /usr/local/avamar var/mc/server_data 2026-02-10 07:45:18 3718 1035377K Linux /usr/local/avamar var/mc/server_data 2026-02-09 08:00:30 3717 1035511K Linux /usr/local/avamar var/mc/server_data-- 或 --
手動步驟（和示例輸出）：- 請遵循解決方案路徑文章中的「案例 1 」：Avamar AUI 中的 DD 顯示紅色
- 為「avtar」產生一組新的用戶端憑證（如果存在）：
檢查「/usr/local/avamar/etc」和「/usr/local/avamar/etc/client」中的用戶端憑證：cd /usr/local/avamar/etc/$(hostname -i)
cd /usr/local/avamar/etc/client/$(hostname -i)
- 如果 兩個命令都 回報「沒有此類檔案或目錄」，則表示 Avamar 未使用用戶端憑證。移至步驟 9。
- 如果 存在任一 目錄，請按照下面的步驟 c-e 操作。
- 移除現有的用戶端憑證目錄：
注意： 複製以下命令，如下所示。請勿修改它們。
rm -r /usr/local/avamar/etc/$(hostname -i)
rm -r /usr/local/avamar/etc/client/$(hostname -i)
- 僅為上述現有目錄產生「avtar」的一組新用戶端憑證：
avagent.bin --gencerts=true --mcsaddr=$(hostname -i)
avagent.bin --gencerts=true --mcsaddr=$(hostname -i) --sysdir=/usr/local/avamar/etc/client
- 測試連線以確認 avtar 是否可以連線至 GSAN：
avtar --backups --path=/MC_BACKUPS --count=5 --encrypt=tls
-
重新註冊所有用戶端和 VMware Proxy：
- 重新註冊代理程式型用戶端：
mccli client re-register-all
- 重新註冊 VMware 代理，方法是從 Avamar 集中重新開機：
mccli mcs reboot-proxy --all
- 重新註冊代理程式型用戶端：
해당 제품
Avamar, Avamar Server제품
Data Domain문서 속성
문서 번호: 000188770
문서 유형: How To
마지막 수정 시간: 14 7월 2026
버전: 44
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.