Test that your system can be resolved using this solution, and then replace the corrupted file.
Step 1: Verify that this article resolves your problem:
- Log on to the ePO Console.
- Click Menu, Configuration, Server Settings.
- Click Server Certificate, Edit, and then click Save.
If you see the following error, this article resolves your problem. Otherwise, contact Technical Support. See the "Related Information" section for details.
"Could not regenerate the server certificate due to an unexpected error. Check the server log for details."
Step 2: Locate the corrupted
ca.keystore file:
- On the ePO Server system:
- Download ePO_KeyInfo_Exporter_v1.2.zip attached to this article to a temporary folder.
- Extract all files.
- Locate the batch file ePO_KeyInfo_Exporter_v1.2.bat.
- Run the batch file as an administrator.
A text file is created named keys.txt, which contains the needed data.
- Open keys.txt with a text editor.
Example A - Output of a corrupted ca.keystore file.
- In this example, the ca.keystore file shows that there's only certificate information. The mykey information is missing.
- File locations:
- server/keystore/ca.keystore
- server/keystore/ca.keystore.old
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Keystore type: JKSKeystore type: JKSKeystore provider: SUN
Your keystore contains 1 entry
Alias name: servercaCreation date: Apr 15, 2014Entry type: trustedCertEntry
Owner: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeIssuer: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeSerial number: 7c02bda704fe36b2Valid from: Wed Dec 31 16:00:00 PST 1969 until: Fri Apr 22 06:35:25 PDT 2039Certificate fingerprints: MD5: 2B:96:D5:D6:B5:E9:C4:02:A8:FB:9D:91:05:AD:E6:3C SHA1: FC:02:F7:72:B9:EB:A7:F5:E6:61:23:C6:9C:ED:31:49:DE:B5:A3:96 SHA256: 7C:73:01:5D:BC:B5:63:13:EB:3B:5B:04:97:5F:6C:5A:A3:EE:AE:A8:FF:A8:71:49:BC:5F:4C:7D:C6:4E:DD:F7 Signature algorithm name: SHA1withRSA Version: 3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Example B - Output of a good
ca.keystore.old file:
- In this example, the file ca.keystore.old shows that there are two certificate bits of information. The mykey information is present.
- File locations:
- server/keystore/ca.keystore
- server/keystore/ca.keystore.old
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Keystore type: JKSKeystore type: JKSKeystore provider: SUN
Your keystore contains 2 entries
Alias name: cacertCreation date: Apr 29, 2009Entry type: trustedCertEntry
Owner: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeIssuer: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeSerial number: 7c02bda704fe36b2Valid from: Wed Dec 31 16:00:00 PST 1969 until: Fri Apr 22 06:35:25 PDT 2039Certificate fingerprints: MD5: 2B:96:D5:D6:B5:E9:C4:02:A8:FB:9D:91:05:AD:E6:3C SHA1: FC:02:F7:72:B9:EB:A7:F5:E6:61:23:C6:9C:ED:31:49:DE:B5:A3:96 SHA256: 7C:73:01:5D:BC:B5:63:13:EB:3B:5B:04:97:5F:6C:5A:A3:EE:AE:A8:FF:A8:71:49:BC:5F:4C:7D:C6:4E:DD:F7 Signature algorithm name: SHA1withRSA Version: 3
**************************************************************************************
Alias name: mykeyCreation date: Apr 29, 2009Entry type: PrivateKeyEntryCertificate chain length: 1Certificate[1]:Owner: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeIssuer: CN=Orion_CA_bhhwapeps1, OU=Orion, O=McAfeeSerial number: 7c02bda704fe36b2Valid from: Wed Dec 31 16:00:00 PST 1969 until: Fri Apr 22 06:35:25 PDT 2039Certificate fingerprints: MD5: 2B:96:D5:D6:B5:E9:C4:02:A8:FB:9D:91:05:AD:E6:3C SHA1: FC:02:F7:72:B9:EB:A7:F5:E6:61:23:C6:9C:ED:31:49:DE:B5:A3:96 SHA256: 7C:73:01:5D:BC:B5:63:13:EB:3B:5B:04:97:5F:6C:5A:A3:EE:AE:A8:FF:A8:71:49:BC:5F:4C:7D:C6:4E:DD:F7 Signature algorithm name: SHA1withRSA Version: 3
**************************************************************************************
Step 3: Continue only if you've located a corrupt
ca.keystore file.
If you see the
mykeyCreation is missing in your output file, take the following action:
- Stop the Tomcat service on the ePO server:
- Press Windows+R.
- Type services.msc into the field and press Enter.
- Right-click McAfee ePolicy Orchestrator #.#.# Application Server and click Stop.
- Leave the services window open.
- Rename the active corrupt file:
- From: ca.keystore
- To: ca.keystore.new
- Rename the good file that contains both keys:
- From: ca.keystore.old
- To: ca.keystore
- Start the Tomcat service on the ePO server:
- Press Windows+R.
- Type services.msc into the field and press Enter.
- Right-click McAfee ePolicy Orchestrator #.#.# Application Server and click Start.
- Close the services window.
- Confirm that the problem is resolved:
- Log on to the ePO Console.
- Click Menu, Configuration, Server Settings.
- Click Server Certificate, Edit, then click Save.
NOTE: When you click Save, no error is shown, which confirms that the problem is resolved.
