NetWorker: Windows NMC Server Fails to Start GSTD Service after Replacing Certificates

A Windows NetWorker Management Console (NMC) server was modified to use a CA signed server certificate instead of the default self-signed certificate.

The NMC GSTD service fails to start with the following error reported in the C:\Program Files\EMC NetWorker\Management\GST\logs\gstd.raw: 

NetWorker: How to use nsr_render_log to render .raw log files

31581 8/6/2025 9:47:37 AM  2 0 0 2044 10296 0 win-srvr01.networker.lan gstd NSR warning *** gstd starting at Wed Aug 06 09:47:37 2025
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice @(#) Product:      NetWorker
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice @(#) Release:      19.9.0.1.Build.29
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice @(#) Build number: 29
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice @(#) Build date:   Sun May 28 23:51:46 PDT 2023
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice Build arch.:  ntx64
0 8/6/2025 9:47:37 AM  1 5 0 2044 10296 0 win-srvr01.networker.lan gstd NSR notice @(#) Build info:   DBG=0,OPT=
57789 8/6/2025 9:47:37 AM  2 0 0 2044 10296 0 win-srvr01.networker.lan gstd NSR warning Error getting certificate and private key for SSL
19154 8/6/2025 9:47:37 AM  2 0 0 2044 10296 0 win-srvr01.networker.lan gstd NSR warning gstd: gt_server: library error 0 os error 

The correct version of OpenSSL for the NMC version was used: 

NetWorker: NMC GST service starts then immediately shuts down after replacing cakey.pem

Encoding issue of the cakey.pem file.

The cakey.pem file was created using PowerShell. The default Out-File format is UTF-16 LE. The file is not read correctly during GSTD service start up, causing the failure.

When creating the cakey.pem file using PowerShell, enforce ASCII encoding.

Example:

Get-Content C:\tmp\server.key.pem, C:\tmp\server.crt.pem | Out-File C:\tmp\cakey.pem -Encoding ascii

For more information, see article NetWorker: How to Import or Replace Certificate Authority Signed Certificates for NMC