PowerProtect Data Manager 19.16 Virtual Machine User Guide

Replace expired or changed certificates on an external server

Use this procedure to replace expired or change certificates on an external server. Only the Administrator role can replace certificates.

1. Log in to the external server as an administrator:
   POST https://server hostname:REST port number/api/v2/login

   Provide the following request payload in JSON format:

   {
   "username": "username",
   "password": "password"
   }
   

   where username is a user with the Administrator role and password is the password for this user.

   NOTE:Add the following header key with your REST call request:

   'Content-type: application/json'

   The response returns the following information:

   {
       "access_token":
       "token_type": 
       "expires_in": 
       "jti": 
       "scope": 
       "refresh_token":
   }

   Copy the access_token value from the response above. This value will be required in the header key Authorization for all the REST calls in subsequent steps.

2. On the REST API client, run the following to obtain the old or expired external server certificate:
   GET https://server hostname:REST port number/api/v2/certificates

   NOTE:Add the following header key with your REST call request:

   'Authorization: access_token_value'

   The response returns a list of certificate entries, each containing the following information:

   [{
       "id": 
       "host": 
       "port": 
       "notValidBefore": 
       "notValidAfter": 
       "fingerprint": 
       "subjectName": 
       "issuerName": 
       "state": 
       "type": 
   }]

   NOTE: Make note of the host, port and type of each certificate, as this information will be required in Step 4. If you supply incorrect information in Step 4, requests that use these external hosts might fail.
3. On the REST API client, delete the old or expired external server certificate from the PowerProtect Data Manager datastore, using the ID obtained from the response in step 2:
   DELETE https://server hostname:REST port number/api/v2/certificates/id

   NOTE:Add the following header key with your REST call request:

   'Authorization: access_token_value'

   Ensure that you delete only the external server certificate that you want to remove.

4. On the REST API client, obtain the new certificate from the external server, using the host, port, and type obtained from the response in step 2:
   GET https://server hostname:REST port number/api/v2/certificates?host=host&port=port&type=type

   NOTE:Add the following header key with your REST call request:

   'Authorization: access_token_value'

   The response returns the following information:

   [{
       "id": 
       "host": 
       "port": 
       "notValidBefore": 
       "notValidAfter": 
       "fingerprint": 
       "subjectName": 
       "issuerName": 
       "state": "UNKNOWN",
       "type": 
   }]

5. On the REST API client, accept the new certificate, using the ID obtained in the response from step 4:
   PUT https://server hostname:REST port number/api/v2/certificates/id

   NOTE:Add the following header key with your REST call request:

   'Authorization: access_token_value'

   Also, copy the response payload from step 4 in JSON format and change the state from "UNKNOWN" to "ACCEPTED".

6. On the REST API client, verify that the new certificate has been accepted, using the ID obtained in the response from step 4:
   GET https://server hostname:REST port number/api/v2/certificates/id

   NOTE:Add the following header key with your REST call request:

   'Authorization: access_token_value'

   If the certificate was accepted, the response returns the following information:

   [{
   "id":
   "host":
   "port":
   "notValidBefore":
   "notValidAfter":
   "fingerprint":
   "subjectName":
   "issuerName":
   "state": "ACCEPTED",
   "type":
   }]