uCMDB 11.33 - certificates in server.keystore overwritten at startup

[ThomasLanz]

Hi experts

I started to use certificates signed by Root CA and tried to replace the OOTB keystore with new certificates.
Using hardening and troubleshooting guide (https://docs.microfocus.com/UCMDB/10.33/ucmdb-docs/docs/eng/doc_lib/Content/admin/ConfigManagDB_tr_trouble_limits.htm?Highlight=keystore) it looks now quit good. But I have strange behaviour at start of the windows service:

Before start my new server.keystore has 3 certificates (1x server, 2x root ca) this looks good with "keytool -list" command.
When starting uCMDB Sevice again the content of server.keystore changes back to default.
Means after startup i can run same command (keytool -list) and i get the default certificate "hpcert".
The password (storepass) value is the same. So I assume there is a startup behaviour which cleans my keystore and loads default certificate back..
How can I prevent this? Any known bug?

Thanks in advance for your help!

[Keith_Paschal]

In the 'Hardening Guide', page 25ish (on 11.0 documentation):

Caution: There can be one server certificate only in server.keystore.

What you should do is:

1. Generate a keystore
2. Create a CSR
3. Get it signed
4. Install it
5. Add Root and intermediate certificates to the cacerts file

[ThomasLanz]

Hi Keith

Thank you for the reply.
Unfortunately this does not really help. I did it exactly this way:

Generate certificate and create CSR, sign using CA, verify using "list".
I tried to rename the alias to "hpcert" but did not help. When starting uCMDB service the server.keystore is updated with default keys..

Any other ideas?

[gmatrozos]

perhaps they help

https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/LID/QCCR1H118157

https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-/facetsearch/document/KM03180777

[GerryLumia]

Hi,

I'm having the same issue. Has anyone found a solution?

Thank you,

Gerry