RSA NetWitness Stale Certificate Probe Check

[#1]

Article Number

000003126

Applies To

RSA Product Set: NetWitness Platform XDR
RSA Product/Service Type: Security-Server
RSA Version/Condition:12.3 and above

Issue

Pre Upgrade Check tool detects the presence of stale certificate entries in Mongo DB with the error “Stale certificate Ids:” with a list of stale certificate IDs.

Image description

NOTE: The presence of stale certificates won’t cause any issues to the environment, but we can see some false positive certificate expiry warnings in the UI popup at some point. Hence, cleaning the stale certificate entries from the mongo is recommended.
 

Cause

These stale certificates are due to decommissioned host certificates in the Mongo database.

Resolution

Run the below commands on admin-server:
1.    To backup certificate entries in mongo:

mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p <deploy_admin_password> --authenticationDatabase admin --db security-server  --collection certificate --out certificate.json
 

Note: Please replace <deploy_admin_password> with the correct password.

2.    Run orchestration-cli-client -l | grep <CERTIFICATE_ID> and orchestration-cli-client -s | grep <CERTIFICATE_ID> to confirm if the certificate is part of the current environment.
3.    Login to mongo using mongo admin -u deploy_admin -p <deploy_admin_password>
4.    Once you are connected to mongo, run command: use security-server
5.    Check the existence of the certificate - db.certificate.find({"_id" : "< CERTIFICATE_ID >"})
6.    Remove the certificate from mongo using db.certificate.remove({"_id" : "< CERTIFICATE_ID >"})