Troubleshooting Cert-Reissue Command
You must contact Customer Support (https://community.netwitness.com/t5/support-information/how-to-contact-netwitness-support/ta-p/563897) to troubleshoot problems. You know there is a problem if any <host-id> does not return a SuccessStatus. Success indicates that certificates were reissued for a host.
Argument Options Used for Troubleshooting
You use the following argument options with cert-reissue --host-all to troubleshoot problems.
You can run cert-reissue --host-all<arguments> multiple times without an adverse effect.
Note: Use the following Argument Options with caution. They force the cert-reissue command to execute for all the hosts.
| Argument Option | Description |
|---|---|
| --skip-health-checks |
Reissues certificates for all hosts at one time without applying system health checks (force Reissue). This means that the command does not:
Use case: You have numerous hosts and you know that a small minority of them will fail. This updates all the hosts that conform to the checking rules and you can reissue certificates for the others subsequently with the help of Customer Support. |
| --skip-version-checks |
Do not verify the version on which the hosts are running. Use Case: You have numerous hosts and your know that some of them are not updated to the latest version.This reissues certificates for all the hosts that are on the latest version and you can reissue certificates for the others subsequently with the help of Customer Support. |
|
--ignore-trigger-errors |
Ignore any errors that trigger failures. This option forces the cert reissue process to continue disregarding the errors instead of aborting or failing the cert reissue command quickly. When a cert reissue for a host succeeds, the reissued certificates on that host are not provisioned to other dependent hosts (referred to as trusts). In this case, the:
|
| --refresh-trusts-only | Refreshes trusts exclusively for host identified by <id> (does not reissue certificates for that host). |
Problems and How to Troubleshoot Them
This section describes solutions to problems that you may encounter when running the cert-reissue command to reissue certificates with suggested causes and solutions.
| Status | Failed! | ||||
| Error Message |
|
||||
| Cause | cert-reissue --host-all failed because one or more hosts are offline or one or more run time services are unreachable. You can force this command to run in spite of this error by specifying the --skip-health-checks option, that is: cert-reissue --host-all--skip-health-checks |
||||
| Solution |
|
||||
| Status | Partial | ||||
| Error Message |
|
||||
| Cause | cert-reissue command completed on NW Server host however one or more triggers failed. This aborted the cert-reissue command for other hosts. | ||||
| Solution |
Address all the errors and run the cert-reissue --host-all<arguments> command string again. |
||||
| Status | Partial | ||||
| Error Message |
|
||||
| Cause | One or more hosts did not pass system health checks. In addition, one or more of the unhealthy hosts are running core services, which will result in the NW Server host cert-reissue to fail (because of failed triggers explained above). By disabling health checks and trigger errors, you can continue the process and reissue certificates for the remaining hosts. The NW Server host Status is reported as Partial because the cert-reissue command completed for the NW Server but downstream triggers failed for other hosts. | ||||
| Solution |
Manually refresh the failed core hosts (to synchronize trust peers). Submit the following command string to reissue certificates for healthy hosts. |
||||
