Avamar：如何重新生成证书

요약: 如何由于到期（或错误配置）而重置或重新生成证书。

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
기타 리소스 확인

지침

应用场景：

  • 按需重新生成证书。
  • Avamar 服务关闭，并且由于证书过期或配置错误而无法重新启动。
提醒：
  • 其中一些过程要求重新启动正在运行的服务。这可能会中断正在运行的备份和复制作业。当 Avamar 维护（检查点 （cp）、检查点验证 （hfscheck） 或垃圾数据收集正在运行）时，不应重新启动服务。
  • 使用 GoAV 工具可以自动重新生成密钥库和更新 Data Domain 证书存储。有关详细信息，请参阅以下文章： Avamar：如何使用 Goav 安全密钥库
  • 在执行任何更新之前， 必须 设置检查点。

查看现有到期时间以确定需要哪些更新：

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 设置“storepath”变量：

    对于 Avamar v19.7 及更高版本：

    storepath=/home/tomcat/.keystore

    对于 Avamar v19.4 及更低版本：

    storepath=/home/admin/.keystore

  4. 运行以下命令以打印证书到期日期：

    storepass=`ask_pass -r keystore_passphrase` && echo "MC Root certificates: " && keytool -list -keystore /usr/local/avamar/lib/avamar_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "MCSDK certificate: " && keytool -list -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Admin/DTLT certificate: " && keytool -list -alias tomcat -keystore $storepath -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Avi certificate: " && keytool -list -alias tomcat -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $storepass -v | egrep "Alias name|Valid from" && echo && echo "Apache certificate: " && openssl x509 -in /etc/apache2/ssl.crt/server.crt -noout -dates

    输出示例（基于 2026 年 2 月 18 日运行的命令）：

    MC Root certificates:
Alias name: mcectls
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030
Alias name: mcrsatls
Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2030
Alias name: mcecroot
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030
Alias name: mcrsaroot
Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2030

MCSDK certificate:
Alias name: mcssl
Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035
Alias name: mcjwt
Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035

Admin/DTLT certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035

Avi certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035

Apache certificate:
notBefore=Feb  1 04:49:34 2022 GMT
notAfter=Jan 31 04:49:34 2027 GMT

    （上面的输出显示没有任何内容已过期）

    MC Root certificates:
Alias name: mcectls
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Mar 12 20:21:48 PST 2026
Alias name: mcrsatls
Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Mar 12 20:21:50 PST 2026
Alias name: mcecroot
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Mar 12 20:21:48 PST 2026
Alias name: mcrsaroot
Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Mar 12 20:21:49 PST 2026

MCSDK certificate:
Alias name: mcssl
Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035
Alias name: mcjwt
Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035

Admin/DTLT certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035

Avi certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035

Apache certificate:
notBefore=Feb  1 04:49:34 2022 GMT
notAfter=Jan 31 04:49:34 2027 GMT

    （上面的输出显示 MC 根证书将在一个月内到期）

    MC Root certificates:
Alias name: mcectls
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2026
Alias name: mcrsatls
Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2026
Alias name: mcecroot
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2026
Alias name: mcrsaroot
Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2026

MCSDK certificate:
Alias name: mcssl
Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035
Alias name: mcjwt
Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035

Admin/DTLT certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035

Avi certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035

Apache certificate:
notBefore=Feb  1 04:49:34 2022 GMT
notAfter=Jan 31 04:49:34 2027 GMT

    （上面的输出显示 MC 根证书已过期）

    MC Root certificates:
Alias name: mcectls
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030
Alias name: mcrsatls
Valid from: Thu Feb 13 20:21:50 PST 2025 until: Tue Feb 12 20:21:50 PST 2030
Alias name: mcecroot
Valid from: Thu Feb 13 20:21:48 PST 2025 until: Tue Feb 12 20:21:48 PST 2030
Alias name: mcrsaroot
Valid from: Thu Feb 13 20:21:49 PST 2025 until: Tue Feb 12 20:21:49 PST 2030

MCSDK certificate:
Alias name: mcssl
Valid from: Thu Feb 13 20:21:43 PST 2025 until: Sun Feb 11 20:21:43 PST 2035
Alias name: mcjwt
Valid from: Thu Feb 13 20:21:45 PST 2025 until: Sun Feb 11 20:21:45 PST 2035

Admin/DTLT certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:02 PST 2025 until: Sun Feb 11 20:22:02 PST 2035

Avi certificate:
Alias name: tomcat
Valid from: Thu Feb 13 20:22:00 PST 2025 until: Sun Feb 11 20:22:00 PST 2035

Apache certificate:
notBefore=Feb  1 04:49:34 2021 GMT
notAfter=Jan 31 04:49:34 2026 GMT

    （上面的输出显示 Apache 证书已过期。）

从下面附录中的适用部分更新相应的证书：

执行更改后验证：

  1. 验证所有 Avamar 服务是否正在运行：

    dpnctl status
  2. 执行测试备份
  3. 执行备份浏览以进行还原

附录：

仅重新生成 Apache 证书：

Apache 证书存储为常规隐私增强邮件 （PEM） 格式的证书文件。

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有证书文件的备份拷贝：

    cp -p /etc/apache2/ssl.crt/server.crt /etc/apache2/ssl.crt/server.crt.`date +%y%m%d`
cp -p /etc/apache2/ssl.key/server.key /etc/apache2/ssl.key/server.key.`date +%y%m%d`

  4. 验证备份拷贝是否存在：

    ls -al /etc/apache2/ssl.crt/server.crt*
ls -al /etc/apache2/ssl.key/server.key*

  5. 可以使用 GoAV（v18.4 及更高版本）或通过运行 Avamar 命令：“
    GoAV”命令（和示例输出）来更新 Apache 证书：
    ./goav security certificate apache regenerate

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 04:52 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:./goav security certificate apache regenerate  ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝
┃ Select a Key Size in bits:
┃ > 2048
┃   3072
┃   4096

    （选择所需的密钥大小，或采用默认值 2048）

    Apache x509 Certificate Configuration
-------------------------------------

Apache Private Key
------------------
Location            /etc/apache2/ssl.key/server.key
Modulus MD5sum      0d35d9c14239093d4f5e28bd5f2f98c8
Key Size            2048

Apache Server Cert
------------------
Location            /etc/apache2/ssl.crt/server.crt
Serial              129741042722659803976190762572696306257
Subject             C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com
Issuer              C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com
Valid Range         YYYY/MM/DD - valid from: 2026/02/18, valid to: 2028/02/18
Modulus MD5sum      0d35d9c14239093d4f5e28bd5f2f98c8
Key Size            2048
Subject Alt Names   server.company.com

    -- 或 --
    Avamar 命令（和输出示例）：
    gen-ssl-cert --updateapache --noupdateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose

           openssl genrsa -out /tmp/gen-ssl-cert-server.key.9085 3072
Generating RSA private key, 3072 bit long modulus
e is 65537 (0x10001)
        openssl req -new -key /tmp/gen-ssl-cert-server.key.9085 -out /tmp/gen-ssl-cert-server.csr.9085 < /tmp/gen-ssl-cert-answers.9085
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
...

           |-30200 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
           `-30206 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
        /sbin/service apache2 stop
        /sbin/service apache2 start

仅重新生成 Tomcat 证书：

  • Tomcat 密钥库存储 Tomcat 证书。
  • 它会根据 Avamar 版本重新生成“/home/tomcat/.keystore”或“/home/admin/.keystore”。

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有密钥库的备份拷贝：

    cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d`

    （在 Avamar 19.4 及更低版本中，请将“/home/admin/.keystore”替换为“/home/tomcat/.keystore”）

  4. 验证备份拷贝是否存在：

    ls -al /home/tomcat/.keystore*

    （在 Avamar 19.4 及更低版本中，请将“/home/admin/.keystore”替换为“/home/tomcat/.keystore”）

  5. 可以使用 GoAV 或通过在 Avamar 上运行以下命令来更新密钥库：

    “GoAV”命令（和示例输出）：
    ./goav security keystore regenerate

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃   RMI_SSL_KEYSTORE
┃   AVAMAR_KEYSTORE
┃   AVI_KEYSTORE
┃ > TOMCAT_KEYSTORE

    （选择“TOMCAT_KEYSTORE”）

    ⣯  Fixing any Tomcat issues
...
══════════════════ Fixing Keystore Issues ══════════════════

Regenerated Tomcat Keystore                               ✓

═══════════════════ Restarting Services ═══════════════════

┃ Tomcat restart required, restart Tomcat?
┃
┃               yes     no

    （选择“yes”）

    ═══════════════════ Restarting Services ═══════════════════

⣻  Restarting Tomcat...
...

Tomcat restarted

    -- 或 --
    Avamar 命令：

    1. 设置“tomcat_keystore”变量：
      对于 Avamar v19.7 及更高版本： 
      storepath=/home/tomcat/.keystore
      对于 Avamar v19.4 及更低版本： 
      storepath=/home/admin/.keystore
    2. 通过运行以下命令重新生成 Tomcat 密钥库： 
      mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
      keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
      keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
      keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
    3. 更新密钥库的权限和所有权：
      对于 Avamar v19.7 及更高版本： 
      chmod 640 $TOMCAT_KEYSTORE
      chown root:tomcat $TOMCAT_KEYSTORE
      对于 Avamar v19.4 及更低版本： 
      chmod 740 $TOMCAT_KEYSTORE
      chown admin:admin $TOMCAT_KEYSTORE

仅重新生成 AVI 证书：

重新生成“/usr/local/avamar/lib/avi/avi_keystore”

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有密钥库的备份拷贝：

    cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d`

  4. 验证备份拷贝是否存在：

    ls -al /usr/local/avamar/lib/avi/avi_keystore*

  5. 可以使用 GoAV 或通过在 Avamar 上运行以下命令来更新密钥库：

    “GoAV”命令（和示例输出）：
    ./goav security keystore regenerate

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃   RMI_SSL_KEYSTORE
┃   AVAMAR_KEYSTORE
┃ > AVI_KEYSTORE
┃   TOMCAT_KEYSTORE

    （选择“AVI_KEYSTORE”）

    ...
══════════════════ Fixing Keystore Issues ══════════════════

Regenerated Avi Keystore                                  ✓

═══════════════════ Restarting Services ═══════════════════

┃ Avinstaller restart required, restart AVI?
┃
┃                yes     no

    （选择“yes”）

    ═══════════════════ Restarting Services ═══════════════════
  
⣽  Restarting Avinstaller...
...
Avinstaller restarted

    -- 或 --
    Avamar 命令（和示例输出）：
    （服务将自动重新启动）

    1. 将当前密钥库放在一旁： 
      mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
    2. 重新生成证书： 
      gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose
      gen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate
        keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US"
gen-ssl-cert: INFO: Successfully created tomcat in java keystore
gen-ssl-cert: INFO: Restarting avinstaller service
gen-ssl-cert: INFO: avinstaller service restart complete
gen-ssl-cert: INFO: Restarting LDLS service
gen-ssl-cert: INFO: LDLS service restart complete
    3. 从“rmi_ssl_keystore”导出别名： 
      keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
      Certificate stored in file </tmp/mcssl.pem>
    4. 将别名导入“avi_keystore”： 
      keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
      Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Serial number: d93e3be
Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036
Certificate fingerprints:
         SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F
         SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 3072-bit RSA key
Version: 3
Trust this certificate? [no]:
      （选择“y”） 
      Certificate was added to keystore
    5. 更新权限和所有权（并验证）： 
      chmod 644 /usr/local/avamar/lib/avi/avi_keystore
      chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
      ls -al /usr/local/avamar/lib/avi/avi_keystore

重新生成管理控制台服务器 （MCS） 开发人员套件 （MCSDK） 证书：

  • 这将更新包含“MCSDK”证书和“JWT”签名密钥的 Avamar RMI 密钥库
  • 它重新生成“/usr/local/avamar/lib/rmi_ssl_keystore”
  • “MCSDK”证书处理与 Data Protection Central （DPC）、Avamar Administrator Console、Proxy Deployment Manager （PDM） 和 Client Manager （AAM） 之间的 Java 远程方法调用 （RMI） 通信。
  • 还应更新 tomcat 证书。Tomcat 密钥库存储 Tomcat 证书。
    • 它会根据 Avamar 版本重新生成“/home/tomcat/.keystore”或“/home/admin/.keystore”
  • 此外，还应更新 AVI 证书
    • 它重新生成“/usr/local/avamar/lib/avi/avi_keystore”

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有密钥库的备份拷贝：

    cp -p /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_ssl_keystore.`date +%y%m%d`
    cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d`
    cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d`

    （在 Avamar 19.4 及更低版本中，请将“/home/admin/.keystore”替换为“/home/tomcat/.keystore”）

  4. 验证备份拷贝是否存在：

    ls -al /usr/local/avamar/lib/rmi_ssl_keystore*
    ls -al /usr/local/avamar/lib/avi/avi_keystore*
    ls -al /home/tomcat/.keystore*

    （在 Avamar 19.4 及更低版本中，请将“/home/admin/.keystore”替换为“/home/tomcat/.keystore”）

  5. 备份 MCS：

    1. 切换到管理员
    2. 运行以下命令以执行 MCS 备份（即 flush）：
      mcserver.sh --flush 
      === BEGIN === check.mcs (preflush)
check.mcs                        passed
=== PASS === check.mcs PASSED OVERALL (preflush)
Flushing Administrator Server...
Administrator Server flushed.
    3. 键入 exit以返回到 root 会话。

  6. 可以使用 GoAV 或通过在 Avamar 上运行以下命令来更新密钥库：

    “GoAV”命令（和示例输出）：

    1. MCSDK：
      ./goav security keystore regenerate 
      ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃ > RMI_SSL_KEYSTORE
┃   AVAMAR_KEYSTORE
┃   AVI_KEYSTORE
┃   TOMCAT_KEYSTORE
      （选择“RMI_SSL_KEYSTORE”） 
      ⣯  Stopping MCS...
...
══════════════════ Fixing Keystore Issues ══════════════════

Regenerated RMI Keystore                                  ✓

══════ Loading vCenter Certificates into RMI Keystore ══════


═══════════════════ Restarting Services ═══════════════════

┃ MCS restart required, restart MCS?
┃
┃            yes     no
      （选择“yes”） 
      ═══════════════════ Restarting Services ═══════════════════

┃ Do you wish to restart the backup scheduler?
┃
┃            yes     no
      （选择“yes”）
      如果在 MCS 重新启动期间收到以下消息： 
      unable to take mcs flush:
The Administrator Server is not running.
ERROR: Cannot flush the Administrator Server while it is not running.
Start the Administrator Server first.
      1. 重新启动 MCS：
        dpnctl start MCS
      2. 重新启动备份计划程序：
        dpnctl start sched
    2. Tomcat：
      ./goav security keystore regenerate 
      ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃   RMI_SSL_KEYSTORE
┃   AVAMAR_KEYSTORE
┃   AVI_KEYSTORE
┃ > TOMCAT_KEYSTORE
      （选择“TOMCAT_KEYSTORE”） 
      ⣯  Fixing any Tomcat issues
...
══════════════════ Fixing Keystore Issues ══════════════════

Regenerated Tomcat Keystore                               ✓

═══════════════════ Restarting Services ═══════════════════

┃ Tomcat restart required, restart Tomcat?
┃
┃               yes     no
      （选择“yes”） 
      ═══════════════════ Restarting Services ═══════════════════

⣻  Restarting Tomcat...
...

Tomcat restarted
    3. AVI：
      ./goav security keystore regenerate 
      ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃   RMI_SSL_KEYSTORE
┃   AVAMAR_KEYSTORE
┃ > AVI_KEYSTORE
┃   TOMCAT_KEYSTORE
      （选择“AVI_KEYSTORE”） 
      ...
══════════════════ Fixing Keystore Issues ══════════════════

Regenerated Avi Keystore                                  ✓

═══════════════════ Restarting Services ═══════════════════

┃ Avinstaller restart required, restart AVI?
┃
┃                yes     no
      （选择“yes”） 
      ═══════════════════ Restarting Services ═══════════════════
  
⣽  Restarting Avinstaller...
...
Avinstaller restarted

    -- 或 --
    Avamar 命令（和输出示例）：

    1. MCSDK：
      1. 将当前密钥库移到一旁：
        mv /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_keystore-$(date -I)
      2. 重新生成密钥库： 
        keytool -genkeypair -v -alias mcssl -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
        keytool -genkeypair -v -alias mcjwt -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
      3. 更新权限和所有权（并验证）： 
        chown root:admin /usr/local/avamar/lib/rmi_ssl+keystore
        chmod 660 /usr/local/avamar/lib/rmi_ssl+keystore
        ls -al /usr/local/avamar/lib/rmi_ssl+keystore
      4. 以管理员身份重新启动 MCS 并启动备份计划程序： 
        mcserver.sh --stop
        mcuserver.sh --start
        dpnctl start sched
    2. Tomcat：
      1. 设置“tomcat_keystore”变量：
        对于 Avamar v19.7 及更高版本： 
        storepath=/home/tomcat/.keystore
        对于 Avamar v19.4 及更低版本： 
        storepath=/home/admin/.keystore
      2. 通过运行以下命令重新生成 Tomcat 密钥库： 
        mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
        keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
        keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
        keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
      3. 更新密钥库的权限和所有权：
        对于 Avamar v19.7 及更高版本： 
        chmod 640 $TOMCAT_KEYSTORE
        chown root:tomcat $TOMCAT_KEYSTORE
        对于 Avamar v19.4 及更低版本： 
        chmod 740 $TOMCAT_KEYSTORE
        chown admin:admin $TOMCAT_KEYSTORE
    3. AVI：
      1. 将当前密钥库放在一旁：
        mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
      2. 重新生成密钥库：
        gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose 
        gen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate
        keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US"
gen-ssl-cert: INFO: Successfully created tomcat in java keystore
gen-ssl-cert: INFO: Restarting avinstaller service
gen-ssl-cert: INFO: avinstaller service restart complete
gen-ssl-cert: INFO: Restarting LDLS service
gen-ssl-cert: INFO: LDLS service restart complete
      3. 从“rmi_ssl_keystore”导出别名： 
        keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
        Certificate stored in file </tmp/mcssl.pem>
      4. 将别名导入“avi_keystore”：
        keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase) 
        Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Serial number: d93e3be
Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036
Certificate fingerprints:
         SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F
         SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 3072-bit RSA key
Version: 3
Trust this certificate? [no]:
        （选择“y”） 
        Certificate was added to keystore
      5. 更新权限和所有权（并验证）： 
        chmod 644 /usr/local/avamar/lib/avi/avi_keystore
        chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
        ls -al /usr/local/avamar/lib/avi/avi_keystore

重新生成管理控制台服务 （MCS） 根证书：

  • 此步骤将更新所有 MCS 根证书。
  • 它会重新生成“/usr/local/avamar/lib/avamar_keystore”
  • 仅当这些证书已过期或即将过期时，才应更新它们。
  • 如果启用了会话安全性，则会影响客户端备份、还原和复制。
  • 全球存储区域网络 （GSAN） 证书也必须重新生成。

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有密钥库的备份拷贝：

    cp -p /usr/local/avamar/lib/avamar_keystore /usr/local/avamar/lib/avamar_keystore.`date +%y%m%d`

  4. 验证备份拷贝是否存在：

    ls -al /usr/local/avamar/lib/avamar_keystore*

  5. 备份 MCS：

    1. 切换到管理员
    2. 运行以下命令以执行 MCS 备份（即 flush）：
      mcserver.sh --flush 
      === BEGIN === check.mcs (preflush)
check.mcs                        passed
=== PASS === check.mcs PASSED OVERALL (preflush)
Flushing Administrator Server...
Administrator Server flushed.
    3. 键入 exit以返回到 root 会话。

  6. 可以使用 GoAV 或通过在 Avamar 上运行以下命令来更新密钥库：

    “GoAV”命令（和示例输出）：
    ./goav security keystore regenerate

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav security keystore    ║
║         regenerate                                     ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

┃ Select Keystore to Regenerate
┃   RMI_SSL_KEYSTORE
┃ > AVAMAR_KEYSTORE
┃   AVI_KEYSTORE
┃   TOMCAT_KEYSTORE

    （选择“AVAMAR_KEYSTORE”）

    ⣯  Stopping MCS...
...
══════════════════ Fixing Keystore Issues ══════════════════

⢿  Fixing any AVAMAR_KEYSTORE issues...

Regenerated Avamar Keystore                               ✓

═══════════════════ Restarting Services ═══════════════════

┃ MCS restart required, restart MCS?
┃
┃            yes     no

←/→ toggle • enter submit • y yes • n no

    （选择“yes”）

    ═══════════════════ Restarting Services ═══════════════════

┃ Do you wish to restart the backup scheduler?
┃
┃            yes     no

    （选择“yes”）

    如果在 MCS 重新启动期间收到以下消息：

    unable to take mcs flush:
The Administrator Server is not running.
ERROR: Cannot flush the Administrator Server while it is not running.
Start the Administrator Server first.
    1. 重新启动 MCS：
      dpnctl start MCS
    2. 重新启动备份计划程序：
      dpnctl start sched

    -- 或 --
    Avamar 命令（和输出示例）：

    1. 将当前密钥库放在一旁：
      mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
    2. 重新生成密钥库：
      mcrootca all 
      INFO: Executing mcrootca...
INFO: Initializing, may take a few moments...
INFO: Generating, saving and verifying MC EC root key and certificate...
INFO: Successfully generated, saved and verified MC EC root key and certificate.
INFO: Generating and saving EC TLS key and certificate...
INFO: Successfully generated and saved EC TLS key and certificate.
INFO: Verifying EC TLS certificate...
INFO: Successfully verified EC TLS certificate.
INFO: Test loading EC CA certificate(s)...
INFO: Successfully loaded EC CA certificate(s)...
INFO: Verifying EC CA certificate(s)...
INFO: Successfully verified EC CA certificate(s)...
INFO: Setting EC root key and certificate as new...
INFO: Successfully set EC root key and certificate as new.
INFO: Generating, saving and verifying MC RSA root key and certificate...
INFO: Successfully generated, saved and verified MC RSA root key and certificate.
INFO: Generating and saving RSA TLS key and certificate...
INFO: Successfully generated and saved RSA TLS key and certificate.
INFO: Verifying RSA TLS certificate...
INFO: Successfully verified RSA TLS certificate.
INFO: Test loading RSA CA certificate(s)...
INFO: Successfully loaded RSA CA certificate(s)...
INFO: Verifying RSA CA certificate(s)...
INFO: Successfully verified RSA CA certificate(s)...
INFO: Test loading TLS certificate...
INFO: Successfully loaded TLS certificate.
INFO: Verifying TLS certificate...
INFO: Successfully verified TLS certificate.
INFO: Setting RSA root key and certificate as new...
INFO: Successfully set RSA root key and certificate as new.
INFO: mcrootca exited with return value = 0
    3. 以管理员身份重新启动 MCS 并启动备份计划程序： 
      mcserver.sh --stop
      mcuserver.sh --start
      dpnctl start sched

  7. 重新生成 GSAN 证书：

    1. 备份“/usr/local/avamar/etc/directory”：
      tar -cvf /home/admin/avamar_etc_bk.`date +%y%m%d` /usr/local/avamar/etc/
    2. 运行以下命令：
      enable_secure_config.sh --certs

  8. 更新 Data Domain （DD） 证书存储：

    这同样可以使用 GoAV 实用程序来完成，也可以手动执行。”
    GoAV“命令（和示例输出）：
    ./goav dd check-ssl --fix

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav dd check-ssl --fix   ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝
Session Security Enabled                                              PASSED
DDR Security Feature Manual Flag                                      PASSED
DDR Host Cert Auto Refresh Flag                                       PASSED
GSAN Cert Chain Expiration                                            PASSED
GSAN Server Cert Expiration                                           PASSED
Get Attached Data Domains                                             PASSED
Check DDR Key exists                                                  PASSED
Test Port 22: dl003.company.com                                       PASSED
Test ddr_key ssh auth: dl003.company.com                              PASSED
DD/Avamar time difference: dl003.company.com                          PASSED
DD SCP enabled: dl003.company.com                                     PASSED
DD NFS enabled: dl003.company.com                                     PASSED
DD system passphrase is set: dl003.company.com                        PASSED
DD imported-host ddboost: dl003.company.com                           PASSED
DD host issuer is attached: dl003.company.com                         PASSED
Av chain.pem imported to DD: dl003.company.com                        FAILED
avamar gsan chain.pem does not exist on Data Domain
TASK: Delete imported-host ddboost                                    DONE
TASK: Load gsan chain depth 0                                         DONE
TASK: Delete imported ca/login auth                                   DONE
TASK: Restart ddboost                                                 DONE
TASK: Stop MCS                                                        DONE
TASK: Start MCS                                                       DONE
TASK: Sync Data Domain                                                DONE
Backup Scheduler Status                                               FAILED
Removed /usr/local/avamar/etc/10.n.n.16                ✓
Removed /usr/local/avamar/etc/client/10.n.n.16         ✓

Generating new certificates...

"/usr/local/avamar/var/.avagent"
avagent Info <19803>: Ignoring the --service flag.
avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16
avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16
2025/01/18-18:20:51.46677 [avagent]  <1291> FIPS mode enabled
avagent Info <42249>: Checking for stale certificate lock
avagent Info <19805>: Creating directory '/usr/local/avamar/etc/10.n.n.16' for certificates
avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/10.n.n.16'
avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none)

avagent Info <18918>: Registration: Processing secure registration with the MCS.
avagent Info <18921>: Registration: Requesting root CA from the MCS.
avagent Info <18926>: Registration: Saving root CA.
avagent Info <18928>: Registration: Creating certificate signing request.
avagent Info <18930>: Registration: Sending the certificate signing request to the MCS.
avagent Info <18932>: Registration: Saving client certificate.
avagent Info <18934>: Registration: Secure registration complete.
avagent Info <41048>: Requesting network configuration from the MCS.
avagent Info <5405>: avagent returning with exitcode 0
2026/02/18-18:20:52.13501 [avagent]  Config: VARDIR=/usr/local/avamar/var, HOMEDIR=/root
2026/02/18-18:20:52.13506 [avagent]  Looking for flag file "/usr/local/avamar/var/avamar.cmd"
2026/02/18-18:20:52.13509 [avagent]  Looking for flag file "/usr/local/avamar/var/avagent.cmd"
2026/02/18-18:20:52.13517 [avagent]  Looking for flag file "/usr/local/avamar/var/.avagent"
avagent Info <19803>: Ignoring the --service flag.
avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client
avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client
2026/02/18-18:20:52.14446 [avagent]  <1291> FIPS mode enabled
avagent Info <42249>: Checking for stale certificate lock
avagent Info <19805>: Creating directory '/usr/local/avamar/etc/client/10.n.n.16' for certificates
avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/client/10.n.n.16'
avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none)

avagent Info <18918>: Registration: Processing secure registration with the MCS.
avagent Info <18921>: Registration: Requesting root CA from the MCS.
avagent Info <18926>: Registration: Saving root CA.
avagent Info <18928>: Registration: Creating certificate signing request.
avagent Info <18930>: Registration: Sending the certificate signing request to the MCS.
avagent Info <18932>: Registration: Saving client certificate.
avagent Info <18934>: Registration: Secure registration complete.
avagent Info <41048>: Requesting network configuration from the MCS.
avagent Info <5405>: avagent returning with exitcode 0

Generated certificates for 10.n.n.16                 ✓

Testing Avtar connection...

avtar Info <5551>: Command Line: /usr/local/avamar/bin/avtar.bin --flagfile=/usr/local/avamar/etc/usersettings.cfg --server=avacrk003 --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --id=root --password=**************** --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --sysdir=/usr/local/avamar/etc --backups --account=/MC_BACKUPS --count=10 --encrypt=tls
avtar Info <7977>: Starting at 2026-02-18 18:20:53 GMT [avtar Dec  8 2023 07:07:43 19.10.100-135 Linux-x86_64]
avtar Info <6555>: Initializing connection
avtar Info <5552>: Connecting to Avamar Server (avacrk003)
avtar Info <5554>: Connecting to one node in each datacenter
avtar Info <5583>: Login User: "root", Domain: "default", Account: "/MC_BACKUPS"
avtar Info <5580>: Logging in on connection 0 (server 0)
avtar Info <5582>: Avamar Server login successful
avtar Info <10632>: Using Client-ID='6638d648ef621aa9dc20be40ab49e0820dac9b39'
avtar Info <5550>: Successfully logged into Avamar Server [19.10.0-135]
avtar Info <19849>: Selecting 10 backups
avtar Info <7377>: Backups for /MC_BACKUPS as of 2025-11-25 18:20:53 GMT
avtar Info <5314>: Command completed (exit code 0: success)
    Date      Time    Seq       Label           Size     Plugin    Working directory         Targets

2026-02-18 18:15:56  3726                     2034984K Linux    /usr/local/avamar     var/mc/server_data
2026-02-17 18:08:30  3725                     2034952K Linux    /usr/local/avamar     var/mc/server_data
2026-02-16 17:31:43  3724                     2033952K Linux    /usr/local/avamar     var/mc/server_data
2026-02-15 08:00:31  3723                     1035390K Linux    /usr/local/avamar     var/mc/server_data
2026-02-14 07:45:20  3722                     1035346K Linux    /usr/local/avamar     var/mc/server_data
2026-02-13 08:00:29  3721                     1035313K Linux    /usr/local/avamar     var/mc/server_data
2026-02-12 07:45:19  3720                     1035269K Linux    /usr/local/avamar     var/mc/server_data
2026-02-11 08:00:30  3719                     1035419K Linux    /usr/local/avamar     var/mc/server_data
2026-02-10 07:45:18  3718                     1035377K Linux    /usr/local/avamar     var/mc/server_data
2026-02-09 08:00:30  3717                     1035511K Linux    /usr/local/avamar     var/mc/server_data

    -- 或 --
    手动步骤（和示例输出）：

    1. 按照解决方案路径文章 Avamar：DD 在 Avamar AUI 中显示红色中的“情景 1”进行操作
    2. 为“avtar”生成一组新的客户端证书（如果存在）。
      检查“/usr/local/avamar/etc”和“/usr/local/avamar/etc/client”中的客户端证书： 
      cd /usr/local/avamar/etc/$(hostname -i)
      cd /usr/local/avamar/etc/client/$(hostname -i)
      • 如果 两个命令都 报告“No such file or directory”，则表示 Avamar 未使用客户端证书。转到步骤 9。
      • 如果存在任一目录，请按照下面的步骤 c-e 进行操作。
    3. 删除现有客户端证书目录：
      注意： 按如下所示复制命令。请勿修改它们。 
      rm -r /usr/local/avamar/etc/$(hostname -i)
      rm -r /usr/local/avamar/etc/client/$(hostname -i)
    4. 仅为上面的现有目录的“avtar”生成一组新的客户端证书： 
      avagent.bin --gencerts=true --mcsaddr=$(hostname -i)
      avagent.bin --gencerts=true --mcsaddr=$(hostname -i) --sysdir=/usr/local/avamar/etc/client
    5. 测试连接以确认 avtar 是否可以连接到“GSAN”： 
      avtar --backups --path=/MC_BACKUPS --count=5 --encrypt=tls

  9. 重新注册所有客户端和 VMware 代理：

    1. 重新注册基于代理的客户端：
      mccli client re-register-all
    2. 通过从 Avamar 集中重新启动 VMware 代理来重新注册它们：
      mccli mcs reboot-proxy --all

重新生成所有证书：

将重新生成上面记录的所有证书和密钥库

  1. 以管理员身份登录到 Avamar Utility Node。

  2. 提升到 root 权限。

  3. 制作现有密钥库的备份拷贝：

    cp -p /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_ssl_keystore.`date +%y%m%d`
cp -p /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore.`date +%y%m%d`
cp -p /home/tomcat/.keystore /home/tomcat/.keystore.`date +%y%m%d`
cp -p /etc/apache2/ssl.crt/server.crt /etc/apache2/ssl.crt/server.crt.`date +%y%m%d`
cp -p /etc/apache2/ssl.key/server.key /etc/apache2/ssl.key/server.key.`date +%y%m%d`
cp -p /usr/local/avamar/lib/avamar_keystore /usr/local/avamar/lib/avamar_keystore.`date +%y%m%d`

  4. 验证备份拷贝是否存在：

    ls -al /usr/local/avamar/lib/rmi_ssl_keystore*
ls -al /usr/local/avamar/lib/avi/avi_keystore*
ls -al/home/tomcat/.keystore*
ls -al /etc/apache2/ssl.crt/server.crt*
ls -al /etc/apache2/ssl.key/server.key*
ls -al/usr/local/avamar/lib/avamar_keystore*

    （同样，在 Avamar 19.4 及更低版本中，请将“/home/admin/.keystore”替换为“/home/tomcat/.keystore”）

  5. 备份 MCS：

    1. 切换到管理员
    2. 运行以下命令以执行 MCS 备份（即 flush）：
      mcserver.sh --flush 
      === BEGIN === check.mcs (preflush)
check.mcs                        passed
=== PASS === check.mcs PASSED OVERALL (preflush)
Flushing Administrator Server...
Administrator Server flushed.
    3. 键入 exit以返回到 root 会话。

  6. GOAV 可用于一次重新生成所有密钥库，也可以通过在 Avamar 上运行命令来重新生成：

    GoAV 命令（和输出示例）：

    1. 重新生成所有密钥库：
      ./goav security keystore regenerate all 
      ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 19 Feb 2026 05:33 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:./goav security keystore regenerate --all      ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝

⣯  Stopping MCS...
...
Regenerated RMI Keystore                                  ✓
Regenerated Avamar Keystore                               ✓
Regenerated Avi Keystore                                  ✓
Regenerated Tomcat Keystore                               ✓
══════ Loading vCenter Certificates into RMI Keystore ══════

═══════════════════ Restarting Services ═══════════════════

┃ MCS restart required, restart MCS?
┃
┃            yes     no
      （选择“yes”） 
      ═══════════════════ Restarting Services ═══════════════════

┃ Do you wish to restart the backup scheduler?
┃
┃            yes     no
      （选择“yes”）
      如果在 MCS 重新启动期间收到以下消息： 
      unable to take mcs flush:
The Administrator Server is not running.
ERROR: Cannot flush the Administrator Server while it is not running.
Start the Administrator Server first.
      1. 重新启动 MCS：
        dpnctl start MCS
      2. 重新启动备份计划程序：
        dpnctl start sched
    2. 重新生成 Apache 证书：
      ./goav security certificate apache regenerate 
      ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 04:52 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:./goav security certificate apache regenerate  ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝
┃ Select a Key Size in bits:
┃ > 2048
┃   3072
┃   4096
      （选择所需的密钥大小，或采用默认值 2048） 
      Apache x509 Certificate Configuration
-------------------------------------

Apache Private Key
------------------
Location            /etc/apache2/ssl.key/server.key
Modulus MD5sum      0d35d9c14239093d4f5e28bd5f2f98c8
Key Size            2048

Apache Server Cert
------------------
Location            /etc/apache2/ssl.crt/server.crt
Serial              129741042722659803976190762572696306257
Subject             C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com
Issuer              C=US, ST=Texas, L=Round Rock, O=Dell Technologies, CN=server.company.com
Valid Range         YYYY/MM/DD - valid from: 2026/02/18, valid to: 2028/02/18
Modulus MD5sum      0d35d9c14239093d4f5e28bd5f2f98c8
Key Size            2048
Subject Alt Names   server.company.com

    -- 或 --
    Avamar 命令（和示例输出）：

    1. MCS 根证书：
      1. 将当前密钥库放在一旁：
        mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
      2. 重新生成密钥库：
        mcrootca all 
        INFO: Executing mcrootca...
INFO: Initializing, may take a few moments...
INFO: Generating, saving and verifying MC EC root key and certificate...
INFO: Successfully generated, saved and verified MC EC root key and certificate.
INFO: Generating and saving EC TLS key and certificate...
INFO: Successfully generated and saved EC TLS key and certificate.
INFO: Verifying EC TLS certificate...
INFO: Successfully verified EC TLS certificate.
INFO: Test loading EC CA certificate(s)...
INFO: Successfully loaded EC CA certificate(s)...
INFO: Verifying EC CA certificate(s)...
INFO: Successfully verified EC CA certificate(s)...
INFO: Setting EC root key and certificate as new...
INFO: Successfully set EC root key and certificate as new.
INFO: Generating, saving and verifying MC RSA root key and certificate...
INFO: Successfully generated, saved and verified MC RSA root key and certificate.
INFO: Generating and saving RSA TLS key and certificate...
INFO: Successfully generated and saved RSA TLS key and certificate.
INFO: Verifying RSA TLS certificate...
INFO: Successfully verified RSA TLS certificate.
INFO: Test loading RSA CA certificate(s)...
INFO: Successfully loaded RSA CA certificate(s)...
INFO: Verifying RSA CA certificate(s)...
INFO: Successfully verified RSA CA certificate(s)...
INFO: Test loading TLS certificate...
INFO: Successfully loaded TLS certificate.
INFO: Verifying TLS certificate...
INFO: Successfully verified TLS certificate.
INFO: Setting RSA root key and certificate as new...
INFO: Successfully set RSA root key and certificate as new.
INFO: mcrootca exited with return value = 0
      3. 以管理员身份重新启动 MCS 并启动备份计划程序： 
        mcserver.sh --stop
        mcuserver.sh --start
        dpnctl start sched
    2. MCSDK：
      1. 将当前密钥库放在一旁：
        mv /usr/local/avamar/lib/rmi_ssl_keystore /usr/local/avamar/lib/rmi_keystore-$(date -I)
      2. 重新生成密钥库： 
        keytool -genkeypair -v -alias mcssl -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
        keytool -genkeypair -v -alias mcjwt -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keystore /usr/local/avamar/lib/rmi_ssl_keystore -validity 3650 -dname "CN=$(hostname -f), OU=Avamar, O=DELL-EMC, L=Irvine, ST=California, C=US" -storepass `ask_pass -r keystore_passphrase` -keypass `ask_pass -r keystore_passphrase` -noprompt
      3. 更新权限和所有权（并验证）： 
        chown root:admin /usr/local/avamar/lib/rmi_ssl+keystore
        chmod 660 /usr/local/avamar/lib/rmi_ssl+keystore
        ls -al /usr/local/avamar/lib/rmi_ssl_keystore
      4. 以管理员身份重新启动 MCS 并启动备份计划程序： 
        mcserver.sh --stop
        mcuserver.sh --start
        dpnctl start sched
    3. Tomcat：
      1. 设置“tomcat_keystore”变量：
        对于 Avamar v19.7 及更高版本： 
        storepath=/home/tomcat/.keystore
        对于 Avamar v19.4 及更低版本： 
        storepath=/home/admin/.keystore
      2. 通过运行以下命令重新生成 Tomcat 密钥库： 
        mv $TOMCAT_KEYSTORE /home/admin/tomcat_keystore.bak
        keytool -genkeypair -v -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 3072 -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase) -validity 3650 -dname "CN=$(hostname -f), OU=Dell EMC, O=Dell Technologies, L=Irvine, ST=California, C=US"
        keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
        keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore $TOMCAT_KEYSTORE -storepass $(avlockbox.sh -r keystore_passphrase)
      3. 更新密钥库的权限和所有权：
        对于 Avamar v19.7 及更高版本： 
        chmod 640 $TOMCAT_KEYSTORE
        chown root:tomcat $TOMCAT_KEYSTORE
        对于 Avamar v19.4 及更低版本： 
        chmod 740 $TOMCAT_KEYSTORE
        chown admin:admin $TOMCAT_KEYSTORE
    4. AVI：（服务将自动重新启动）
      1. 将当前密钥库放在一旁：
        mv /usr/local/avamar/lib/avi/avi_keystore /usr/local/avamar/lib/avi/avi_keystore-$(date -I)
      2. 重新生成密钥库：
        gen-ssl-cert --norestart --noupdateapache --updateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose 
        gen-ssl-cert: INFO: Regenerating avinstaller SSL certifcate
        keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA512withRSA -keysize 3072 -keypass ######### -storepass ########## -keystore /usr/local/avamar/lib/avi/avi_keystore -validity 3650 -dname "CN=server.company.com, O=Dell Technologies, OU=Dell EMC, L=Irvine, S=CA, C=US"
gen-ssl-cert: INFO: Successfully created tomcat in java keystore
gen-ssl-cert: INFO: Restarting avinstaller service
gen-ssl-cert: INFO: avinstaller service restart complete
gen-ssl-cert: INFO: Restarting LDLS service
gen-ssl-cert: INFO: LDLS service restart complete
      3. 从“rmi_ssl_keystore”导出别名： 
        keytool -export -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/rmi_ssl_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
        Certificate stored in file </tmp/mcssl.pem>
      4. 将别名导入“avi_keystore”：
        keytool -import -file /tmp/mcssl.pem -alias mcssl -keystore /usr/local/avamar/lib/avi/avi_keystore -storepass $(avlockbox.sh -r keystore_passphrase) 
        Owner: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Issuer: CN=server.company.com, OU=Avamar, O=Dell, L=Irvine, ST=California, C=US
Serial number: d93e3be
Valid from: Wed Feb 18 16:11:15 PST 2026 until: Sat Feb 16 16:11:15 PST 2036
Certificate fingerprints:
         SHA1: 82:82:81:B4:C9:BD:03:E1:8A:E0:AE:8A:59:55:EF:B5:1F:3B:27:5F
         SHA256: AC:E7:AE:CE:04:13:E0:86:88:1E:3E:FA:17:DA:B6:A5:3D:3D:74:F3:EB:70:57:63:58:B1:74:B3:50:28:EA:01
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 3072-bit RSA key
Version: 3
Trust this certificate? [no]:
        （选择“y”） 
        Certificate was added to keystore
      5. 更新权限和所有权（并验证）： 
        chmod 644 /usr/local/avamar/lib/avi/avi_keystore
        chown avi:avi /usr/local/avamar/lib/avi/avi_keystore
        ls -al /usr/local/avamar/lib/avi/avi_keystore
    5. Apache：
      gen-ssl-cert --updateapache --noupdateavi --keystorepwd=$(avlockbox.sh -r keystore_passphrase) --verbose 
             openssl genrsa -out /tmp/gen-ssl-cert-server.key.9085 3072
Generating RSA private key, 3072 bit long modulus
e is 65537 (0x10001)
        openssl req -new -key /tmp/gen-ssl-cert-server.key.9085 -out /tmp/gen-ssl-cert-server.csr.9085 < /tmp/gen-ssl-cert-answers.9085
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
...

           |-30200 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
           `-30206 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
        /sbin/service apache2 stop
        /sbin/service apache2 start

  7. 重新生成 GSAN 证书：

    1. 备份“/usr/local/avamar/etc/directory”：
      tar -cvf /home/admin/avamar_etc_bk.`date +%y%m%d` /usr/local/avamar/etc/
    2. 运行以下命令：
      enable_secure_config.sh --certs

  8. 更新 Data Domain （DD） 证书存储：

    这同样可以使用 GoAV 实用程序来完成，也可以手动执行。”
    GoAV“命令（和示例输出）：
    ./goav dd check-ssl --fix

    ╔════════════════════════════════════════════════════════╗
║ GoAV                                             v2.02 ║
╟────────────────────────────────────────────────────────╢
║ Build : 02 Feb 2026 19:03 UTC                          ║
║ Date  : 18 Feb 2026 05:37 UTC                          ║
║ Avamar: 19.4.100-124                                   ║
╟────────────────────────────────────────────────────────╢
║ Command:/home/admin/20260218/goav dd check-ssl --fix   ║
╟────────────────────────────────────────────────────────╢
║ NOTE: This tool was created and is maintained          ║
║       by the ISG Support Tools team.                   ║
╚════════════════════════════════════════════════════════╝
Session Security Enabled                                              PASSED
DDR Security Feature Manual Flag                                      PASSED
DDR Host Cert Auto Refresh Flag                                       PASSED
GSAN Cert Chain Expiration                                            PASSED
GSAN Server Cert Expiration                                           PASSED
Get Attached Data Domains                                             PASSED
Check DDR Key exists                                                  PASSED
Test Port 22: dl003.company.com                                       PASSED
Test ddr_key ssh auth: dl003.company.com                              PASSED
DD/Avamar time difference: dl003.company.com                          PASSED
DD SCP enabled: dl003.company.com                                     PASSED
DD NFS enabled: dl003.company.com                                     PASSED
DD system passphrase is set: dl003.company.com                        PASSED
DD imported-host ddboost: dl003.company.com                           PASSED
DD host issuer is attached: dl003.company.com                         PASSED
Av chain.pem imported to DD: dl003.company.com                        FAILED
avamar gsan chain.pem does not exist on Data Domain
TASK: Delete imported-host ddboost                                    DONE
TASK: Load gsan chain depth 0                                         DONE
TASK: Delete imported ca/login auth                                   DONE
TASK: Restart ddboost                                                 DONE
TASK: Stop MCS                                                        DONE
TASK: Start MCS                                                       DONE
TASK: Sync Data Domain                                                DONE
Backup Scheduler Status                                               FAILED
Removed /usr/local/avamar/etc/10.n.n.16                ✓
Removed /usr/local/avamar/etc/client/10.n.n.16         ✓

Generating new certificates...

"/usr/local/avamar/var/.avagent"
avagent Info <19803>: Ignoring the --service flag.
avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16
avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16
2025/01/18-18:20:51.46677 [avagent]  <1291> FIPS mode enabled
avagent Info <42249>: Checking for stale certificate lock
avagent Info <19805>: Creating directory '/usr/local/avamar/etc/10.n.n.16' for certificates
avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/10.n.n.16'
avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none)

avagent Info <18918>: Registration: Processing secure registration with the MCS.
avagent Info <18921>: Registration: Requesting root CA from the MCS.
avagent Info <18926>: Registration: Saving root CA.
avagent Info <18928>: Registration: Creating certificate signing request.
avagent Info <18930>: Registration: Sending the certificate signing request to the MCS.
avagent Info <18932>: Registration: Saving client certificate.
avagent Info <18934>: Registration: Secure registration complete.
avagent Info <41048>: Requesting network configuration from the MCS.
avagent Info <5405>: avagent returning with exitcode 0
2026/02/18-18:20:52.13501 [avagent]  Config: VARDIR=/usr/local/avamar/var, HOMEDIR=/root
2026/02/18-18:20:52.13506 [avagent]  Looking for flag file "/usr/local/avamar/var/avamar.cmd"
2026/02/18-18:20:52.13509 [avagent]  Looking for flag file "/usr/local/avamar/var/avagent.cmd"
2026/02/18-18:20:52.13517 [avagent]  Looking for flag file "/usr/local/avamar/var/.avagent"
avagent Info <19803>: Ignoring the --service flag.
avagent Info <5702>: Command Line: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client
avagent Info <5703>: Parsed Flags: avagent.bin --gencerts=true --mcsaddr=10.n.n.16 --sysdir=/usr/local/avamar/etc/client
2026/02/18-18:20:52.14446 [avagent]  <1291> FIPS mode enabled
avagent Info <42249>: Checking for stale certificate lock
avagent Info <19805>: Creating directory '/usr/local/avamar/etc/client/10.n.n.16' for certificates
avagent Info <19807>: Creating certificates in '/usr/local/avamar/etc/client/10.n.n.16'
avagent Info <43701>: agent_message::resolve_client_ip ping to MCS 10.n.n.16:10.n.n.16 using local IP:(none) failed, Program malfunction, Parse bind IP failed for IP: (none)

avagent Info <18918>: Registration: Processing secure registration with the MCS.
avagent Info <18921>: Registration: Requesting root CA from the MCS.
avagent Info <18926>: Registration: Saving root CA.
avagent Info <18928>: Registration: Creating certificate signing request.
avagent Info <18930>: Registration: Sending the certificate signing request to the MCS.
avagent Info <18932>: Registration: Saving client certificate.
avagent Info <18934>: Registration: Secure registration complete.
avagent Info <41048>: Requesting network configuration from the MCS.
avagent Info <5405>: avagent returning with exitcode 0

Generated certificates for 10.n.n.16                 ✓

Testing Avtar connection...

avtar Info <5551>: Command Line: /usr/local/avamar/bin/avtar.bin --flagfile=/usr/local/avamar/etc/usersettings.cfg --server=avacrk003 --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --id=root --password=**************** --vardir=/usr/local/avamar/var --bindir=/usr/local/avamar/bin --sysdir=/usr/local/avamar/etc --backups --account=/MC_BACKUPS --count=10 --encrypt=tls
avtar Info <7977>: Starting at 2026-02-18 18:20:53 GMT [avtar Dec  8 2023 07:07:43 19.10.100-135 Linux-x86_64]
avtar Info <6555>: Initializing connection
avtar Info <5552>: Connecting to Avamar Server (avacrk003)
avtar Info <5554>: Connecting to one node in each datacenter
avtar Info <5583>: Login User: "root", Domain: "default", Account: "/MC_BACKUPS"
avtar Info <5580>: Logging in on connection 0 (server 0)
avtar Info <5582>: Avamar Server login successful
avtar Info <10632>: Using Client-ID='6638d648ef621aa9dc20be40ab49e0820dac9b39'
avtar Info <5550>: Successfully logged into Avamar Server [19.10.0-135]
avtar Info <19849>: Selecting 10 backups
avtar Info <7377>: Backups for /MC_BACKUPS as of 2025-11-25 18:20:53 GMT
avtar Info <5314>: Command completed (exit code 0: success)
    Date      Time    Seq       Label           Size     Plugin    Working directory         Targets

2026-02-18 18:15:56  3726                     2034984K Linux    /usr/local/avamar     var/mc/server_data
2026-02-17 18:08:30  3725                     2034952K Linux    /usr/local/avamar     var/mc/server_data
2026-02-16 17:31:43  3724                     2033952K Linux    /usr/local/avamar     var/mc/server_data
2026-02-15 08:00:31  3723                     1035390K Linux    /usr/local/avamar     var/mc/server_data
2026-02-14 07:45:20  3722                     1035346K Linux    /usr/local/avamar     var/mc/server_data
2026-02-13 08:00:29  3721                     1035313K Linux    /usr/local/avamar     var/mc/server_data
2026-02-12 07:45:19  3720                     1035269K Linux    /usr/local/avamar     var/mc/server_data
2026-02-11 08:00:30  3719                     1035419K Linux    /usr/local/avamar     var/mc/server_data
2026-02-10 07:45:18  3718                     1035377K Linux    /usr/local/avamar     var/mc/server_data
2026-02-09 08:00:30  3717                     1035511K Linux    /usr/local/avamar     var/mc/server_data

    -- 或 --
    手动步骤（和示例输出）：

    1. 按照解决方案路径文章 Avamar：DD 在 Avamar AUI 中显示红色中的“情景 1”进行操作
    2. 为“avtar”生成一组新的客户端证书（
      如果存在）：检查“/usr/local/avamar/etc”和“/usr/local/avamar/etc/client”中的客户端证书： 
      cd /usr/local/avamar/etc/$(hostname -i)
      cd /usr/local/avamar/etc/client/$(hostname -i)
      • 如果 两个命令都 报告“No such file or directory”，则表示 Avamar 未使用客户端证书。转到步骤 9。
      • 如果存在任一目录，请按照下面的步骤 c-e 进行操作。
    3. 删除现有客户端证书目录：
      注意： 按如下所示复制命令。请勿修改它们。 
      rm -r /usr/local/avamar/etc/$(hostname -i)
      rm -r /usr/local/avamar/etc/client/$(hostname -i)
    4. 仅为上面的现有目录的“avtar”生成一组新的客户端证书： 
      avagent.bin --gencerts=true --mcsaddr=$(hostname -i)
      avagent.bin --gencerts=true --mcsaddr=$(hostname -i) --sysdir=/usr/local/avamar/etc/client
    5. 测试连接以确认 avtar 是否可以连接到 GSAN： 
      avtar --backups --path=/MC_BACKUPS --count=5 --encrypt=tls

  9. 重新注册所有客户端和 VMware 代理：

    1. 重新注册基于代理的客户端： 
      mccli client re-register-all
    2. 通过从 Avamar 集中重新启动 VMware 代理来重新注册它们： 
      mccli mcs reboot-proxy --all

 

해당 제품

Avamar, Avamar Server

제품

Data Domain
문서 속성
문서 번호: 000188770
문서 유형: How To
마지막 수정 시간: 14 7월 2026
버전:  44
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.