Cert error in migration

[lpphiggp]

This is baffling. I'm migrating an OES11sp1 server to new hardware running OES11sp2; when configuring the miggui utility, it continues to give me a certificate error for the source server.

1) Indeed, I discovered the certs had expired for the source server. I repaired all four certs in iManager, and validated them. The certs validate now, happy happy.
2) For good measure, I also ran namconfig -k on the server.
3) I even ran namconfig cache_refresh.
4) Lastly, I went into /opt/novell/migration/plugin/conf on the target server, and deleted the SourceServerCert.der file.

I should be good now, right?
Nope.

Still complains about the cert being expired. Where does the migration pull this "SourceServerCert.der" from? I figured it pulled it from eDirectory. I noticed on the source server that under /etc/ssl/servercerts, the pem files are still showing the old certs, is the migration pulling the cert from here? (I guess not, I did a manual export from iManager, and ran openssl to covert the pkcs12 pfx file to pem format, still no luck.)
I'm stumped.

[thsundel]

lpphiggp;2350083 wrote:
This is baffling. I'm migrating an OES11sp1 server to new hardware running OES11sp2; when configuring the miggui utility, it continues to give me a certificate error for the source server.

1) Indeed, I discovered the certs had expired for the source server. I repaired all four certs in iManager, and validated them. The certs validate now, happy happy.
2) For good measure, I also ran namconfig -k on the server.
3) I even ran namconfig cache_refresh.
4) Lastly, I went into /opt/novell/migration/plugin/conf on the target server, and deleted the SourceServerCert.der file.

I should be good now, right?
Nope.

Still complains about the cert being expired. Where does the migration pull this "SourceServerCert.der" from? I figured it pulled it from eDirectory. I noticed on the source server that under /etc/ssl/servercerts, the pem files are still showing the old certs, is the migration pulling the cert from here? (I guess not, I did a manual export from iManager, and ran openssl to covert the pkcs12 pfx file to pem format, still no luck.)
I'm stumped.

Did you restart ndsd after repairing the certs? I usually reboot the server after renewing the certs.

Thomas

[lpphiggp]

No, I didn't want to interrupt the user's access to their files. I'll give that a shot, but honestly, I shouldn't think that'd be necessary, it wasn't in NetWare. I'd done migration from NetWare to OES-Linux, where the NetWare boxe's certs had expired, did a quick repair (either iManager or pkidiag) and it worked immediately.

[kjhurni]

lpphiggp;2350389 wrote:
No, I didn't want to interrupt the user's access to their files. I'll give that a shot, but honestly, I shouldn't think that'd be necessary, it wasn't in NetWare. I'd done migration from NetWare to OES-Linux, where the NetWare boxe's certs had expired, did a quick repair (either iManager or pkidiag) and it worked immediately.

I believe, if you've had to run a repair on the default certs, that the ndsd process is supposed to auto-check (I forget the interval) and auto-import/read/whatever the newly updated certs.

However, I've found repeatedly over time that some things just will not work until you bounce the server, even IF you manually restart ndsd (of course, restarting ndsd interrupts your users NCP connection to the server in question).

LUM in particular has problems where it gets something stuck in memory and just won't write the proper cert files, no matter what (it seems). And since the miggui loves to use/rely upon LUM ....

There's lots of things in NetWare (for good or bad) that worked differently than OES.

--Kevin

[laurabuckley]

Hi,

Perhaps try this to sort your certificates out: https://www.novell.com/communities/coolsolutions/cool_tools/certificate-recreation-script-oes1-and-oes2/

It is also for OES11.

Cheers,

[lpphiggp]

Thanks Laura, I'll check that out!

[lpphiggp]

We found we had to reboot the server anyway, trying to sync the migration (bypassing SSL) eventually led to it hanging. Now it's all good. Thanks everyone.