Article Number
000002109
Applies To
RSA Product Set: NetWitness Platform
RSA Product/Service Type: RSA NetWitness Platform
RSA Version/Condition: 11.6.x and later
Platform: CentOS
O/S Version: 7
Issue
NetWitness certificate reissue fails when respond service is offline.
Cause
This issue occurs when the upgrade is performed in an environment which does not have Event Stream Analysis (ESA).Follow these steps to reproduce the issue:
- Set up an environment without Event Stream Analysis (ESA). For example, 11.6.0.0.
- Observe that the respond server service on the SA node is Green on the UI and active(running) in the backend.
- Perform cert-reissue on the SA node. The cert-reissue process completes successfully.
- Upgrade the setup.
- Observe that after successful upgrade, the respond server service on the SA node is Offline on the UI, but active(running) in the backend.
- Perform cert-reissue on the SA node. The cert-reissue fails with the same error as observed in customer Environment.
FATAL: Mixlib::ShellOut::ShellCommandFailed: nw_pki_bootstrap_launch[reissue certs for rsa-nw-respond-server] (rsa-response::certreissue line 11) had an error: Mixlib::ShellOut::ShellCommandFailed: execute[respond-server-get-operational-csr] (/var/lib/netwitness/config-management/cache/cookbooks/nw-pki/resources/bootstrap_launch.rb line 238) had an error: Mixlib::ShellOut::ShellCommandFailed: Command execution failed. STDOUT/STDERR suppressed for sensitive resource
Resolution
1. Comment out the response recipe from:
vi /var/netwitness/config-management/cookbooks/launch/rsa-response/recipes/certreissue.rb
a. service_name = node['rsa-response']['service_names'].first
b. component_name = node['rsa-response']['component_name']
c. #nw_pki_bootstrap_launch "reissue certs for #{service_name}" do
d. #service_name service_name
e. #component_name component_name
f. #pki_cert_namespace cookbook_name
g. #use_http false
h. #only_if { node['packages'][service_name] }
i. #end
:wq!
2.
Reissue certificate Notes:
- The recipe will get overwritten after an upgrade. Make sure to comment it out again when cert-reissue is attempted.
- Respond server certificate will not get renewed and may show a pop-up banner on the UI when it is close to expiry. We can remove the certificate at that point as it is not in active use. It might get created during the next upgrade.
